اقرار

Interactive piece

Capture the flags

Six flags are hidden around this site, each shaped like Q{...}. Paste one below to check it. Hints unlock as you find more.

Reading this site's public source on GitHub is a completely legitimate technique; real researchers read source too. The flags are sitting in a data file there. Finding them live is more fun, but a flag is a flag.

Checking happens entirely in your browser: each guess is hashed with SHA-256 and compared against the six hashes on this page. Nothing is sent anywhere, and your progress is kept only in this browser's local storage.

Checking needs JavaScript, and happens entirely in your browser.

0 of 6 found

  1. Unfound

    Between the tags

    • Not everything in a page is meant to be rendered.
    • Locked: find 2 more flags

  2. Unfound

    Talking to developers

    • Some messages are only for people who open the developer tools.
    • Locked: find 2 more flags

  3. Unfound

    Responsible disclosure

    • There is a standard place to learn how to report a vulnerability here.
    • Locked: find 2 more flags

  4. Unfound

    Legacy login

    • Bots try the same few admin paths on every site they find.
    • Locked: find 2 more flags

  5. Unfound

    Nowhere

    • Sometimes the quickest way to find something is to get lost.
    • Locked: find 2 more flags

  6. Unfound

    The polite robot

    • Crawlers are asked, politely, to stay out of some places.
    • Locked: find 2 more flags