Overview
The flag is the heart of every CTF. It is the proof that you solved a challenge. When you exploit a vulnerability, decode a message, or recover hidden data, the payoff is a flag — a unique string you submit to earn points. This lesson explains what flags are, how they look, and how submission works.
Learning objectives
- Define what a flag is and why it exists.
- Recognize the common flag format used by most CTFs.
- Understand how flag submission and scoring work.
Core concept
A flag is a special, hard-to-guess string that a challenge author hides so that only someone who actually solves the challenge can find it. It exists to make success verifiable: instead of judging whether you "understood" a task, the platform simply checks whether you produced the correct, unique string. Finding the flag is the goal.
How it works
Most CTFs use a recognizable flag format, typically a prefix followed by content inside braces, for example flag{...} or an event-specific tag like CTF{...}. The prefix makes flags easy to spot in output, and the braces mark the exact boundaries of the string. When you find a flag:
- You copy the entire string, including the prefix and braces.
- You paste it into the challenge's submission box.
- The platform compares it to the stored answer and, if it matches, awards the points.
Flags are usually unique per challenge and sometimes per team, which lets organizers detect flag sharing. Because matching is exact, a single wrong or missing character means an incorrect submission.
Practical example
A challenge hides a flag inside an image's metadata. After extracting it, you see the text flag{m3ta_data_h1des_secrets}. You select the whole string — prefix, braces, and all — and paste it into the submission field. The platform confirms it is correct and adds the points to your score. Submitting only m3ta_data_h1des_secrets without the flag{...} wrapper would be marked wrong, because the expected answer is the complete string.
Cybersecurity relevance
Flags model a real security principle: objective, verifiable proof. In professional work, a finding is credible when it is demonstrable and reproducible, not merely asserted. The flag mechanism trains you to reach a concrete, checkable result. It also reinforces attention to detail — exact strings, correct encodings, no truncation — which matters when handling tokens, hashes, and keys in real systems.
Common mistakes
- Submitting only part of the flag, dropping the prefix or braces.
- Copying trailing spaces or newlines that break the exact match.
- Guessing or brute-forcing the submission box instead of actually solving the challenge.
Key takeaways
- A flag is a unique, hard-to-guess string that proves you solved a challenge.
- Flags usually follow a
prefix{...}format; submit the entire string exactly as found. - Matching is exact and flags are often unique, so precision matters and sharing can be detected.
Check your understanding
- Why do CTFs use unique, exactly-matched flags instead of grading your explanation?
- What parts of
flag{...}must be included when you submit?