Capture the Flags

This website permanently hides 5 flags in the format NEX{like_this}.
No registration, no time limit, no scoreboard pressure. Just you, a browser, and a mildly smug rat.

This is George. He guards the flags.

Photo: Peter Cooper Jr., CC0 1.0, via Wikimedia Commons

• In scope: Everything this website voluntarily serves to a normal browser: HTML, view-source, robots.txt, the sitemap, linked files.
• Rule of thumb: If it takes more than a normal browser request, it is not part of the game.
• Out of scope: Exploits of any kind, privilege escalation or rooting servers, vulnerability scanners, bruteforce (yes, including the password reset page), DoS or load testing, other subdomains and hosts, social engineering.
• Planted files are marked: Every file placed for the game carries the first-line marker # [NEX-CTF] This file is part of the Nexcurity CTF. Its content is fiction. A find with neither this marker nor a NEX{...} flag is not part of the game.
• Think you found something real?
  • Mail to: security@nexcurity.com

We are aware that bots and scrapers do not read rules. That is known, priced in, and the reason some of our URLs are more welcoming than they deserve to be.

Mail your flags to: george@nexcurity.com

George trades flags for stickers: include a shipping address for a physical sticker (used once, then deleted), or get a digital badge if you’d rather not share one.

By the way, George also reads encrypted mail. Finding his key is up to you.

Want to appear in the hall of fame? Say so explicitly and name the handle we should list. No real names, no addresses, removal on request.

• No entries yet. George remains the sole keeper of all flags.