← Back to Mission Control

🔍 View Source

What you see on a webpage isn't everything. Code is hiding underneath. Right-click anywhere and choose View Page Source (or press Ctrl+U) to reveal the secrets.

0/6 solved · 0/120 pts

🛠️ How To View Source

Right-click anywhere on this page → View Page Source (or press Ctrl+U). You'll see the HTML code that makes this page. Flags can be hidden in comments, invisible text, attributes, and CSS. Use Ctrl+F in the source view to search for agent{ to help you find flags.

Developers often leave notes in the code that visitors can't see on screen — but the notes are still there if you look at the source.

Open the page source (Ctrl+U), search for agent{, and find the hidden comment near the top of the page.

In HTML, comments look like this: . They're invisible on screen but visible in source. Search for the word SECRET in the source code.

✓ Found the hidden comment! Developers often leave notes, TODOs, and secrets in comments.

There's a secret message somewhere on this page, but it's completely invisible — the text is the same colour as the background. You won't see it just by looking. But it's right there in the source code.

Use Ctrl+U to view source, then search for invisible-text to find where it's hiding. Or try selecting all the text on this page with Ctrl+A.

agent{invisible-ink}

In the source, look for class="invisible-text". The text inside is the flag — it's just set to the same colour as the background so you can't see it on screen.

✓ Invisible ink! Hiding text by making it the same colour as the background is a classic trick.

HTML elements can have class and id attributes — labels used to target them with CSS or JavaScript. Usually these are just boring names like header or button-primary...

But sometimes a developer hides something in one of these labels. View source and look carefully at the attributes on the elements below.

Mystery Box A

Mystery Box B

Mystery Box C

In the source, look for id= and class= attributes on the Mystery Box elements. One of the id values is the flag.

✓ The flag was a class/id name! Real websites often expose internal logic through attribute names.

Every image on a webpage has an alt attribute — a text description that appears if the image fails to load, and is read out by screen readers for people who are blind.

Usually the alt text describes what the image shows. But sometimes it holds a secret. View source and find the alt attribute of the image below.

agent{alt-text-secret}

In the source, find the <img> tag for the image above. Look at its alt="..." attribute — the value inside the quotes is the flag.

✓ Hidden in the alt text! Developers sometimes leave notes or debug info in image descriptions.

This button used to do something. Now it's disabled — you can't click it. But disabled doesn't mean empty. The original JavaScript code that ran when you clicked it is still sitting there in the source.

View source, find this button, and read its onclick attribute carefully.

Find the <button> tag in the source. Look at its onclick="..." attribute — it calls a function and passes a value in. That value is the flag.

The button has onclick="unlockVault('agent{...}')". Whatever is inside the single quotes is the flag. Look carefully at the attribute value.

✓ The code was still there even though the button was disabled! Always check event handlers in source.

You've already found flags in HTML comments. But CSS has its own comment syntax too — and developers leave notes in CSS just as often as in HTML.

View source, find the <style> block near the top of the page (in the <head> section), and read through the CSS comments.

CSS comments look like this: /* this is a CSS comment */. They're inside <style> tags. Look in the <head> section of the page source.

In the source view, look near the top for <style> and then find a /* ... comment. A developer left a TODO note with the flag inside it.

✓ CSS comments are just as revealing as HTML ones! Real security researchers check both.