The club's old archive server is being wiped on Friday. Before it goes, find out what it still gives away: five flags, each found with a skill from Digital systems (decoding, page source, the command line, a tiny processor and a key word). Then close the archive's leaks so the secrets can be changed.
Five club secrets are still sitting in the old archive. Find them before Friday, so they can be changed.
Builds on: Text as numbers (Digital systems › Data representation)
A capture the flag (CTF) is a security challenge: you look for what a system gives away, with permission, and each find is a flag, a secret like WP{…} to type in. The archive is the club's and yours to check. Every flag is something that should never have been there, so the club can change it.
Make your prediction first. Help opens once you've locked it in.
Look at the characters: which rule could make them?
It took more than one rule. Decode what comes out, too.
What does a visitor's browser receive that the page doesn't show?
View source, and read every line.
Read readme.txt first.
Out of sight: names starting with a dot are hidden from plain ls.
The minutes are long: grep can pull out one line.
Run the program and write down its outputs.
The outputs are character codes, like in Text as numbers.
a is 97, b is 98, c is 99…
Do any public decoders work?
It's encrypted with a key word you've already met in this archive.
The hidden folder's name, without its dot.
Flag 1 (encoding). The archive's front page had this note. Decode it.
Flag 2 (page source). The front page shows nothing but a password box. What does it give away?
Flag 3 (command line). The old minutes are somewhere in the archive folder. Find the flag in them.
Flag 4 (processor). The archive's old program prints a word as numbers. Run it and read them as text. The flag is WP{ then the word, then }.
Flag 5 (key). The last note is encrypted with the club's key word. Decrypt it.
For each leak: after the fix, does a visitor's browser still receive it?
Before Friday, fix what the archive's front page gives away.
Use the board. This ticks when you get there.
The course challenge. Students find five flags in the club's fictional old archive, each with a skill from Digital systems (layered decoding, page source, ls -a and grep, a tiny processor's output read as character codes, and a key word kept beside its data), name the weakness behind each, and fix the front page's leaks (AC9TDI8K02 node 4, AC9TDI10P14 node 3). Defensive throughout. A 5E mission lesson. About 50 minutes.
Open the teacher guide: answers, solutions, slides and a worksheet.
Try each flag yourself. Everything is made up and runs on the board; nothing touches a real system.
Flags (for you, not students): 1 WP{layers-of-encoding} (base64, then hex), 2 WP{view-the-source} (the hidden field), 3 WP{grep-finds-it} (ls -a, then .gears/minutes.txt), 4 WP{cpu} (outputs 99, 112, 117), 5 WP{keys-unlock-it} (key word gears).
Skills used: Encoding is not encryption and What your page gives away (this course); The command line lessons 1 and 2; A tiny processor (From gates to a processor) and Text as numbers. Students who haven't done the command line or processor courses can still get flags 3 and 4 with the hints, a code table and a few minutes' demo.
Rules of the game: only test what you own or have permission to test, as here. Every find is reported and fixed. For more practice beyond this site, picoCTF (Carnegie Mellon) is free for school students; check its account and age requirements, and your school's policy, first.
Optional: run it as a class event (pairs, first to five), keeping the hints available.
Flags 3 and 5 depend on each other (the hidden folder's name is the key word). Students who skip flag 3 get stuck on 5: send them back.
Stretch: Design a sixth flag for the archive using another Digital systems idea (binary, pixels, or packets), with three escalating hints.
Support: A card listing the five skills and where each was taught.
End of the course. Security and privacy (Years 9–10) has its own capture the flag on a school portal.