CyberQuest - POGIL Activity

Capture the Flag and OSINT Ethics

A guided-inquiry activity. Work in a team of 3 to 4, or on your own. Read each Model, then answer the Critical Thinking Questions in order before revealing a hint.

Learning objectives

Reverse a flag that was hidden in two steps, in the correct order.
State what EXIF photo metadata can reveal and how to remove it.
State and apply the permission rule that separates a white hat from a criminal.

Prerequisites: Base64 and XOR (Day 3).

Team roles

Manager - keeps time, makes sure everyone participates, keeps the team on task.

Recorder - writes the team's agreed answers and questions to ask.

Presenter - speaks for the team and shares answers.

Reflector - watches teamwork and suggests one improvement.

Model 1: A two-step flag

A flag was hidden by first XOR-ing with a key, then Base64 encoding the result.

make:    flag  ->  XOR with key  ->  Base64 encode  ->  given to you
recover: given  ->  Base64 decode ->  XOR with key  ->  flag

To recover the flag, which step do you undo first, and why?
Check your thinking
Undo the last step that was applied first: Base64 decode first, then XOR. You reverse the steps in the opposite order.
If you XOR-decoded before Base64-decoding, what would happen?
Check your thinking
It would fail or give garbage, because the data is still Base64 text at that point, not the XORed bytes.

Model 2: Hidden data in a photo (EXIF)

Camera:       Pixel 8
DateTaken:    2026-06-05 14:32
GPSLocation:  38.8895, -77.0353

List two things this metadata reveals that a person might not want public.
Check your thinking
When and where the photo was taken (date/time and GPS location), and the device model.
How could you protect yourself before posting a photo?
Check your thinking
Turn off location tagging on the camera, or strip the metadata before sharing.

Model 3: Is it allowed?

action	allowed?
Solve a picoCTF challenge in picoGym	yes (built for practice)
Look up a public company profile for OSINT practice	yes (public information)
Log into a stranger account you guessed	no (no permission)
Scan a website you do not own	no (no permission)

What single rule decides every row in Model 3?
Check your thinking
Permission and using only public data: you may only test or access systems you own or are explicitly allowed to test.
In one sentence, what makes someone a white hat rather than a criminal?
Check your thinking
A white hat uses the same skills only with permission, to protect people and systems rather than to harm them.

Do it now

Open Day5.ipynb and recover the two-step flag, then read the EXIF example. Practice on picoCTF picoGym and explore the OSINT Framework, public targets only.

Application

A teammate wants to test a flaw on a real store website. Using Model 3, explain in two sentences why that is not allowed and what to do instead.

Reflection (process skills)

How did your team make sure everyone understood the reverse-the-steps idea before moving on?

All POGIL activities · Main course deck · Camp home