Years 8–10. Two skills a defender needs, then a capture the flag that uses everything: encoding is not encryption (binary, hex and base64 are public rules anyone can undo), and what your own web page gives away (comments, hidden fields, scripts and photo details reach every visitor). Then the old club archive: five flags found with decoding, page source, the command line, a tiny processor and a key word, and the leaks fixed before it closes. Defensive and fictional throughout.
★ Challenge completeEncoding is not encryption; what your page gives away.
Binary, hex and base64 are encodings: the same data written another way by a public rule. They look scrambled, but anyone can turn them back, so they hide nothing. Encryption needs a secret key as well: without it, the data can't be read. Use encryption to keep something secret, and hashing (Security and privacy) to store passwords.
A web page is sent whole to every visitor's browser, so its source is theirs to read: comments, hidden fields and scripts, even when the page doesn't show them. Photos can carry where they were taken. And a check that runs in the browser can be skipped. Keep secrets and real checks on the server, and strip photo details before you upload.
Five flags from across Digital systems, then close the archive safely.
The club's old archive server is being wiped on Friday. Before it goes, find out what it still gives away: five flags, each found with a skill from Digital systems (decoding, page source, the command line, a tiny processor and a key word). Then close the archive's leaks so the secrets can be changed.
Progress is saved in this browser only. Nothing is sent anywhere.
For teachers: Teacher guide (notes, answers, solutions, slides and worksheets)