JAVASCRIPT IN PRACTICE

Find the flag

Find the flag - locate a hidden value in DevTools (HTML comment, header, localStorage, XHR). Trains recon.

  • HTML source
  • Response headers
  • Browser data
Start the first challenge →

First challenge without login · Free

Selected challenges to get started

Pick a challenge and explore the rules through a concrete example.

Warm-up

Flag in a comment

Open the target and inspect the page source. Developers sometimes leave things in HTML comments. Find the flag and paste it below.

Solve challenge → No login required
Warm-up

Flag in a response header

The flag is not on the page. But a server response is more than its body - it also has headers. Open the Network tab in DevTools and inspect the response headers.

Preview challenge → Free account required to solve
Warm-up

Flag in localStorage

Sites keep data on the browser side. Open the target, go to the Application tab in DevTools and look into Local Storage.

Preview challenge → Free account required to solve

Ready for more?

Available challenges: 13.

See all challenges →

The full catalogue requires a free account.

How should you approach these challenges?

Flag-finding challenges practise page inspection with DevTools: you discover information in HTML, HTTP responses or browser storage. Similar observation helps testers and frontend developers identify the data an application actually exposes to the client.

Open the target and look for information already exposed by the prepared page. Follow the task clues to inspect HTML source, network responses and browser storage. Reload the page with Network open to see requests. Once you find the flag, copy it in full into the answer field.

Put it into practice: Flag in a comment →

Solve this challenge without creating an account.