Six flags
They're all somewhere on this site. Flags look like m4t{...}. Easy at the top, harder at the bottom.
0 of 6 solved
- flag 1 · easy
Source
Start where everyone starts on a web challenge.
- flag 2 · easy
Do not crawl
Some paths are listed so crawlers stay away. People aren't crawlers.
- flag 3 · medium
Headers
The homepage says more than it renders.
- flag 4 · medium
Crumbs
This page left you something. Two layers of encoding.
- flag 5 · hard
History
Boot the desktop. The user forgot to clean up after themselves.
-
flag 6 · hardest
EWS-07
An engineering workstation at a water plant started acting strange after someone opened a project from a USB drive. You get its process telemetry and a list of known-good hashes.
Find the binary that is pretending to be something it isn't. The impostor was spawned by another process; the first field is that parent's PID, not the impostor's own. Flag:
m4t{<pid of the parent process that launched it>_<first 8 hex of its sha256>_<its decoded tag>}