Capture the flag: the old archive

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can use decoding, page source, the command line and character codes to find what a system gives away.
• I can name the weakness behind each find.
• I can say how each one should be fixed.

Timing

Engage 3 min · Explore (flags) 30 min · Explain 5 min · Elaborate 7 min · Evaluate 5 min

Before class

Try each flag yourself. Everything is made up and runs on the board; nothing touches a real system.

Flags (for you, not students): 1 WP{layers-of-encoding} (base64, then hex), 2 WP{view-the-source} (the hidden field), 3 WP{grep-finds-it} (ls -a, then .gears/minutes.txt), 4 WP{cpu} (outputs 99, 112, 117), 5 WP{keys-unlock-it} (key word gears).

Skills used: Encoding is not encryption and What your page gives away (this course); The command line lessons 1 and 2; A tiny processor (From gates to a processor) and Text as numbers. Students who haven't done the command line or processor courses can still get flags 3 and 4 with the hints, a code table and a few minutes' demo.

Rules of the game: only test what you own or have permission to test, as here. Every find is reported and fixed. For more practice beyond this site, picoCTF (Carnegie Mellon) is free for school students; check its account and age requirements, and your school's policy, first.

Optional: run it as a class event (pairs, first to five), keeping the hints available.

Running the lesson

1. Engage: ask why a server that's about to be wiped still matters.
2. Explore: circulate; ask which skill each flag needs before giving a hint.
3. Explain: go through the five weaknesses and their fixes as a class.
4. Elaborate: ask what the club must do after the page is fixed (change every secret).
5. Evaluate: discuss why finders report rather than keep.

The hard part (on purpose)

Flags 3 and 5 depend on each other (the hidden folder's name is the key word). Students who skip flag 3 get stuck on 5: send them back.

When students get stuck

Answers to the checks

1. Engage: why look?: The archive is being wiped on Friday anyway. Why check what it gives away first?
   Secrets that leaked may still work: the same passwords and codes are often reused. Find them, then change them.
2. Flag 1: the note: Flag 1 (encoding). The archive's front page had this note. Decode it.
   A flag (the exact answer is in the teacher notes)
   Base64, then hex: two public rules, no key. Encoding hides nothing.
3. Flag 2: the page: Flag 2 (page source). The front page shows nothing but a password box. What does it give away?
   A flag (the exact answer is in the teacher notes)
   A hidden field held it: not shown, but sent to every visitor.
4. Flag 3: the minutes: Flag 3 (command line). The old minutes are somewhere in the archive folder. Find the flag in them.
   A flag (the exact answer is in the teacher notes)
   ls -a shows the hidden folder .gears; grep Flag .gears/minutes.txt finds the line. Hidden is not private. Remember the folder's name.
5. Flag 4: the old program: Flag 4 (processor). The archive's old program prints a word as numbers. Run it and read them as text. The flag is WP{ then the word, then }.
   A flag (the exact answer is in the teacher notes)
   99, 112, 117 are c, p, u: each output is 32 more than a capital letter's code, so the program turned CPU into lower case.
6. Flag 5: the locked note: Flag 5 (key). The last note is encrypted with the club's key word. Decrypt it.
   A flag (the exact answer is in the teacher notes)
   The key word was gears, the hidden folder's name. A key kept next to the data it protects protects nothing.
7. Explain: what each flag shows: Which flag shows that a key stored beside the data it protects is no protection?
   Flag 5: the key word was the hidden folder's name
   Keys belong somewhere else (a password manager, the server), never next to what they lock.
8. Elaborate: close the archive: Before Friday, fix what the archive's front page gives away.
   
   The backup value is gone, and the password check and the files are protected on the server. Then the club changes every secret you found.
9. What next?: You found five secrets in the archive. What should happen next?
   Report them so each one is changed, and fix where they leaked
   Find, report, change, fix: that's what a CTF is practice for.

Solutions

One possible solution for each task. Other correct programs are fine.

Elaborate: close the archive

Open task: any program that does what the step asks.

Stretch and support

Stretch: Design a sixth flag for the archive using another Digital systems idea (binary, pixels, or packets), with three escalating hints.

Support: A card listing the five skills and where each was taught.

Exit ticket

Pick one flag: what gave it away, and how should the club fix it?

For example: the hidden field sent the backup value to every visitor; remove it and keep data on the server.

What each step is for

• Engage: why look?: Committing to why a club checks its own old server frames the challenge as defence: find what's exposed, then fix it.
• Explore: five flags: Each flag needs one skill from Digital systems applied to the archive; the hints escalate and never give the flag.
• Explain: what each flag shows: Naming the weakness behind each flag turns the hunt into a list of fixes.
• Elaborate: close the archive: Ending a CTF the way defenders do: every finding becomes a fix.

Where it leads

End of the course. Security and privacy (Years 9–10) has its own capture the flag on a school portal.