Years 8–10. Two skills a defender needs, then a capture the flag that uses everything: encoding is not encryption (binary, hex and base64 are public rules anyone can undo), and what your own web page gives away (comments, hidden fields, scripts and photo details reach every visitor). Then the old club archive: five flags found with decoding, page source, the command line, a tiny processor and a key word, and the leaks fixed before it closes. Defensive and fictional throughout.
Each lesson works two ways. Students can work through the online tutorial at their own pace (it checks their answers and saves their progress in their browser), or you can teach it to the whole class from the slides, then send students into the tutorial for the Modify and Make steps.
Every lesson guide has plain-language notes, the answers to every check, a solution for every task, and slides and a worksheet for Waypoints Prepare. These guide pages are not linked from student pages, but they are not secret either: keep printed Teacher editions for answers you do not want students to find.
Whole-course cheat sheet: Open to print (every command, grouped by unit: a handout for the final challenge)
Encoding is not encryption; what your page gives away.
Encoding writes data in another form by a public rule: binary, hex and base64 look scrambled, but anyone can turn them back, so they hide nothing. Encryption needs a secret key as well; without the key, the data can't be read. (Hashing, in Security and privacy, is one-way: for checking passwords, not for reading them back.)
A web page is sent whole to every visitor's browser. Comments, hidden fields, scripts and a photo's details (often the place it was taken) aren't shown on the page, but anyone can read them with View source or by saving the file. And a check that runs in the browser can be skipped by its visitor, so real checks happen on the server.
Students check the Coding Club's own pages and messages before anyone else does, then fix what they find. Everything is made up; addresses use the example domains.
Only test what you own or have been given permission to test, as here. Every finding is fixed and reported.
Networks (who can see your data), How a web page is made (source and structure), Cyber safety and privacy (the Australian Privacy Principles), Security and privacy (hashes and keys).
encoding, encryption, key, base64, hex, page source, hidden field, metadata, server.
Cheat sheet: Open to print (A4, with board pictures) · Markdown
Five flags from across Digital systems, then close the archive safely.
Cheat sheet: Open to print (A4, with board pictures) · Markdown