What a flag looks like, why it exists, the places flags hide, and how to submit one without losing marks to a typo.
About 7 minutes · 3 tasks
A flag is a piece of secret text that you can only get by solving the challenge. Think of it as a golden ticket hidden inside the puzzle: having it proves you got all the way there.
Flags exist so that scoring can be automatic and fair. No judge has to read an explanation of how you solved something. The platform simply compares your text with the real flag. If they match, you get the points straight away.
On ZeroDay Alliance, every flag has the same three parts:
zda{h3ll0_h4ck3r}
That odd spelling is called leet speak: 3 for e, 0 for o, 1 for i or l, 4 for a. It is a CTF tradition, and it is useful. When decoded text suddenly reads as h3ll0_h4ck3r, you can be confident you have found the real thing and not random data.
Your turn
Practice only: hints are free and nothing here affects your score.
Flags rarely sit in plain sight. Where one hides depends on the kind of challenge, and learning these places is most of what makes you good at CTFs:
| Category | Where the flag might be | How you get it |
|---|---|---|
| Web | In a comment in the page source, in a cookie, or on an admin page you aren’t meant to reach | Read what the site sends you, then change what you send back |
| Crypto | Scrambled, like emRhe2ZsYWd9 | Work out how it was encoded or encrypted, then undo it |
| Forensics | Inside a file’s metadata, a deleted file, or a recorded network conversation | Search and extract with tools |
| Steganography | Invisibly inside the pixels of an image or the sound of an audio file | Examine what is hidden under the surface |
| Reversing | Inside a program, which only accepts the correct secret | Read the program’s logic and work backwards |
| Pwn | In flag.txt on a remote server, readable only by that server's program | Exploit a bug to make the program hand it over |
| OSINT | Nowhere on the platform: the answer is public information | Research it, then wrap it up, like zda{kolkata} |
Challenge authors sometimes plant fake flags to catch people who don't check closely. Compare what you find against the exact format, then have a go at this one.
[09:14:02] INFO backup started: flag{this_is_the_wrong_format}
[09:14:03] INFO loaded 2,481 records
[09:14:03] WARN old key found: ZDA{uppercase_is_not_valid}
[09:14:05] INFO user "admin" signed in from 10.0.4.17
[09:14:06] DEBUG session token zda[n0t_th3_r1ght_br4ck3ts]
[09:14:06] DEBUG cache note: zda{y0u_f0und_m3}
[09:14:09] INFO backup finished in 7sYour turn
Practice only: hints are free and nothing here affects your score.
Finding a flag is the hard part, so don't lose it to a typo. The checker compares text exactly:
0 with O, or 1 with l.zda{Flag} and zda{flag} are different flags.| If the real flag is zda{h3ll0}, this… | …fails because |
|---|---|
ZDA{h3ll0} | The prefix is in the wrong case |
h3ll0 | The prefix and braces are missing |
zda{hello} | The real flag has a 3 and a 0, not an e and an o |
zda{h3ll0 } | The space is inside the braces, so it counts |
Your turn
Practice only: hints are free and nothing here affects your score.
zda{Secret}, but the real flag is zda{secret}. What happens?