Capture The Flag

Foundation Lab: Building the Security Analyst Mindset

General Instructions

Follow the steps for each mode to capture the flags. Submit a document with all 5 Flags and a brief explanation for each including what you did and what you learned. Screenshots are recommended.

MODE 1

Cryptography

Objective: Understand common encodings and data transformation.

Base64 is a binary-to-text encoding scheme. Decode the string below to find your first flag.

RkxBR3tjcmlwdG9fYmFzaWNzfQ==
  1. Navigate to the decoding tool via the link below.
  2. Select Base64 Decode.
  3. Paste the encoded text and reveal the flag.
Open Cryptii
Reflection Question: What is Base64 encoding used for, and why is it not considered encryption?
MODE 2

Web Inspection

Objective: Learn how information looks while inspecting the elements.
  1. Open the target webpage using the link below.
  2. Right-click anywhere on the page and select Inspect.
  3. Open the Elements tab and scan the HTML comments
  4. Find the word "of" how many times its occurance in the text?
Open Target Page
Reflection Question: Why should sensitive information never be stored in client-side HTML comments?
MODE 3

Steganography

Objective: Understand how data is hidden inside media files.

Target File: bisy3006_lab.png

Lab Steganography Image
  1. Download the image provided above.
  2. Upload it to the Steganography Online tool below.
  3. Extract the hidden message to reveal your flag.
Open Stegano Tool
Reflection Question: What real-world risks does steganography introduce in cybersecurity?
MODE 4

Regular Expressions

Objective: Identify patterns using RegEx.

Target Log Data:

User log:admin_01 logged inguest logged inadmin_99 logged inroot logged inadmin_07 logged in
  1. Paste the log text above into the Regex101 tool.
  2. Enter the following pattern: admin_[0-9]+
  3. Confirm that only valid admin users are highlighted.
Open Regex101
Reflection Question: How can poor regex design lead to security vulnerabilities?
MODE 5

OSINT

Objective: Use public data to reveal technical details.
  1. Navigate to the WHOIS search tool.
  2. Search for the domain: example.com
  3. Identify the Registrar name to find the final flag.
Open WHOIS
Reflection Question: Why is OSINT a critical phase in penetration testing and threat intelligence?