Never solved a Capture-The-Flag challenge before? This is the walkthrough I wish I'd had. We'll go from "what even is a flag" to capturing your first one — using only your browser and a methodical checklist you can reuse on every web challenge.
What a CTF actually is
A CTF challenge hides a secret string — the flag, usually formatted like AYSEC{...} — somewhere you're not supposed to find it. Your job is to find it using the same techniques real attackers use, but in a legal sandbox. Submit the flag, get points. That's it.
Web challenges are the best place to start: no special tools, no setup, just your browser and curiosity.
The beginner's checklist (do these in order)
1. Read everything on the page
Flags hide in plain sight more often than you'd think. Look at the page, the title, any