What does cybersecurity protect?#

The CIA triad gives us three useful goals:

• Confidentiality: only authorized people can read the data.
• Integrity: nobody can change the data without permission.
• Availability: authorized users can reach the service when they need it.

Security is a balance. A system must block unauthorized access while remaining usable for legitimate users.

Four words for describing a security problem#

The phrase “not visible on the page” describes the interface. It says nothing about whether the server checked permission.

Stay inside the authorization boundary#

Use security tools only on your own device, the local course lab, or another target whose owner has clearly granted permission. Do not scan the school network, another student’s device, a real account, or an unfamiliar website.

If you unexpectedly find a problem on a real service, stop testing. Preserve only the minimum evidence needed to explain the issue, avoid collecting personal data, and use the site’s published security contact.

What happens when a browser opens a page?#

The browser sends a request to a web server. The server checks it and returns a status code, headers, and a response body.

1
Browser: GET /index.html
2
Server: 200 OK
3
Server: HTML response body

The browser may then request CSS, JavaScript, images, and API data. Developer tools expose this normal exchange:

• Elements shows the current document structure.
• View Source shows the original HTML response.
• Sources contains downloaded scripts and style sheets.
• Network records requests, status codes, headers, and responses.
• Application contains cookies and browser storage.

Assume that users can inspect anything delivered to their browser.

Start a local lab#

Extract the course lab into its own directory and open a terminal in that directory. Do not type a shell prompt symbol shown in an example.

On macOS or Linux:

1
python3 -m http.server 8000

On Windows:

1
py -m http.server 8000

Open http://localhost:8000 in a browser. Here, localhost means this computer and 8000 is the listening port. Keep the terminal open, and press Ctrl+C when the lab is over.

Flag 01: HTML comments are visible#

Comments do not appear in the rendered page, but they remain part of the HTML response.

1
<body>
2
  <h1>Turing Club member page</h1>
3
  <!-- flag{html_is_visible} -->
4
</body>

Open View Source and search for flag{. Never leave passwords, private URLs, debug details, or personal data in HTML comments.

Flag 02: the browser receives front-end JavaScript#

This value reaches the user’s computer even when the page never displays it:

1
const clubCode = "flag{javascript_is_visible}";
2
console.log("Page loaded");

Open Sources and search for clubCode. Minification and obfuscation may slow a reader down, but they do not turn client-side code into a secret. Database passwords, private tokens, and administrative credentials do not belong in browser code.

Flag 03: Base64 is an encoding#

The following text looks unfamiliar:

1
ZmxhZ3tlbmNvZGluZ19pc19ub3RfZW5jcnlwdGlvbn0=

Base64 decoding produces:

1
flag{encoding_is_not_encryption}

Base64 changes how data is represented. It does not require a key, so anyone can decode it. Encryption requires a key and a design that protects that key.

The correct fix belongs on the server#

A weak design sends the secret first and then hides it with CSS, JavaScript, comments, or encoding. Once the browser has the data, the user can recover it.

A protected request should work differently:

1. The browser requests the protected resource.
2. The server verifies the user’s identity and permission.
3. An authorized user receives only the data needed for the task.
4. An unauthorized user receives 401 Unauthorized or 403 Forbidden, without the sensitive body.

Authentication answers “Who are you?” Authorization answers “What are you allowed to do?” A signed-in user does not automatically have access to every record.

Record more than the flag#

For each challenge, write down where you found the data, which tool revealed it, why the exposure happened, and how the server should prevent it. A good lab note explains the security boundary instead of stopping at the answer.

Before you finish, answer three questions: How is hiding an element different from enforcing permission? Which kind of front-end exposure is easiest to overlook? How should you report a real vulnerability without increasing its impact?