🏴 My First CTF — Web Challenge Writeup (NahamCon 2025)

A beginner-friendly challenge that teaches you to never underestimate simplicity

🧠 Challenge Overview

The challenge presented a very minimalistic webpage with no visible links, scripts, or interactions. All it showed was a cryptic string in the description:

Nz Gjstu DUG

It looked like gibberish at first, but it was clearly a clue.

🕵️ Initial Analysis — What’s “Nz Gjstu DUG”?

Looking closely, this appeared to be a simple Caesar Cipher, specifically ROT-1 (rotate each letter by one position back).

Using any ROT decoder:

Nz Gjstu DUG → My First CTF

Nice! That confirmed our suspicion — we’re likely looking for a file named something like flag.txt, maybe obfuscated with the same cipher.

🔍 Recon & Enumeration

There were no visible links or resources on the page, so I started manually guessing hidden paths based on the ROT-1 logic.

Let’s try encoding flag.txt with ROT-1:

f → g  
l → m  
a → b  
g → h  
. → .  
t → u  
x → y  
t → u

=> gmbh.uyu

So, I navigated to:

https://3lw6bi8o.eu1.ctfio.com/gmbh.uyu

Boom! 🎉

😏 A Troll Message?

The page displayed this message:

Ha, you wish!

At first, I thought it was a dead end… but then I noticed something interesting.

My browser downloaded a file automatically.

A closer look revealed: it was flag.txt.

🎯 The Flag

Opening the file gave me:

flag{b67779a5cfca7f1dd120a075a633afe9}

✔️ Challenge complete!

🧠 Takeaways

• Always pay attention to hints, especially simple ciphers like Caesar.
• Just because a page shows nothing, doesn’t mean it does nothing.
• Always watch for unexpected downloads — the flag might be hiding there.
• Trust your instincts and dig a bit deeper. Sometimes the simplest CTFs teach the best lessons.

Thanks for reading! If you found this writeup helpful, drop a 👏 or follow me for more beginner-friendly CTF content. Happy hacking! 🐱‍💻