Challenge: Baby Web · CTF: DalCTF 2026 · Category: Web · Difficulty: Easy

TL;DR

The whole challenge is a single static HTML page stuffed with the Boss Baby movie transcript. The flag is sitting right there in the page source, wrapped in a paragraph with a hidden="true" attribute so it never renders in the browser. View the source (or curl + grep) and the flag falls straight out.

1

dalctf{n0w_y0u_ar3_th3_b0ss_b4by}

Recon

We’re handed a URL:

1

https://dalctf-baby-web-277-64616c.instancer.dalctf2026.com/

First thing I always do on a web challenge — pull the raw response with headers, no browser rendering, nothing hidden from me:

1

curl -s -i "https://dalctf-baby-web-277-64616c.instancer.dalctf2026.com/" | head -60

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

HTTP/2 200
accept-ranges: bytes
content-type: text/html
server: nginx/1.31.1
content-length: 51971

<!DOCTYPE html>
<html>
<head>
    <title>Baby Web</title>
</head>
<body style="background-color: beige;">
    <h1 style="color:darkblue;text-align:center;">A Treatise on DreamWork Animation's The Boss Baby</h1>
    ...

A ~52 KB page titled “A Treatise on DreamWork Animation’s The Boss Baby” — and the body is, quite literally, a wall of text recounting the entire plot of the movie. No forms, no login, no obvious API. Just nginx serving a static file.

The challenge name Baby Web plus the description “Your first step to becoming the boss, baby!” screams beginner / view-source challenge. The “treatise” is a haystack, and the flag is the needle.

Finding the needle

When the content is a giant blob of prose, don’t read it — grep it. Save the page and search for anything an author would plausibly leave behind:

1
2
3

curl -s "https://dalctf-baby-web-277-64616c.instancer.dalctf2026.com/" -o baby.html

grep -n -iE "flag|<!--|<script|href|<form|<input|secret|hint|password|admin" baby.html

A few lines stand out:

1
2

346:    <p hidden="true"> Nice work, here's the flag: dalctf{n0w_y0u_ar3_th3_b0ss_b4by} </p>
546:    I bet you're looking for a flag so I'll tell you it's somewhere in the transcript.</h2>

Line 546 is the in-page hint — the author tells you straight up that the flag is hidden somewhere in the transcript. And line 346 is the payload:

1

<p hidden="true"> Nice work, here's the flag: dalctf{n0w_y0u_ar3_th3_b0ss_b4by} </p>

Why you don’t see it in the browser

The trick is the hidden global attribute. When an element has hidden, the browser applies display: none and the element is never painted — so scrolling through the rendered page, you’d never spot that paragraph. But hidden is purely a rendering hint. The element is still right there in the DOM and, more importantly, in the raw HTML that the server sends you.

That’s the entire lesson of this challenge: what the browser shows you and what the server sends you are not the same thing. Client-side hiding (hidden, display:none, white-text-on-white, off-screen positioning, etc.) is never a security boundary.

Any of these would have found it just as fast:

  • View Source in the browser (Ctrl+U) and Ctrl+F for flag
  • curl ... | grep flag
  • DevTools → Elements, search the DOM
  • Reader mode (which ignores hidden)

Flag

1

dalctf{n0w_y0u_ar3_th3_b0ss_b4by}

Takeaways

  • Always read the source. On any web challenge, the raw HTML/JS is the first place to look — comments, hidden elements, inline scripts, and stray endpoints live there.
  • Grep the haystack. When a page is mostly noise (a transcript, lorem ipsum, an article), don’t scan with your eyes. grep -i flag and the common-keyword sweep do it in one shot.
  • hidden / display:none is not security. Anything sent to the client is visible to the client. If a real app hid a secret this way, it’d be a genuine information-disclosure bug.

And with that — now you are the Boss Baby. Binky. Papish. 🍼