Capture the flag5 flagsbeginner-friendly
Five flags. One site.
I've hidden five flags across harshsec.in. They all look like HSEC{…}. No hacking the server, no brute force — just curiosity and the tools already in your browser.
Submit a flag
Pick a handle the first time you submit — this browser remembers it so nobody else can use it.
Leaderboard
| # | Handle | Flags |
|---|---|---|
| Loading… |
Stuck? Hints.
Open one only when you need it.
Flag 01
Every page has two faces: the one you see, and the one your browser reads. Try Ctrl U on the homepage.
Flag 02
Search engines get their own instructions. Where would a site tell a crawler where not to go?
Flag 03
Developers talk to themselves in a place most visitors never open. F12 might help.
Flag 04
There's a string in the footer of the work log that looks like gibberish. It isn't encrypted — it's just encoded.
Flag 05
My AI terminal answers questions — but a few classic Linux commands are handled before the AI ever sees them. What would an attacker try first once they're "in"?