Hack4Gov was my first Capture-The-Flag competition.
To be honest, I only joined because my friends convinced me to (with a bit of FOMO). I wasn’t someone who actively studied cybersecurity, and it isn’t where I want to build my career. Most of my experience has always been in web development. That ended up mattering more than I expected.
I spent almost the entire competition working on web challenges.
I solved two web exploitation problems early, then hit a wall. For hours, nothing worked. I switched challenges, helped with OSINT, took breaks, came back, and still got nowhere.
Eventually I returned to one web challenge involving Next.js middleware. I kept trying different ideas until something clicked.
I remembered a video from Theo that talked about a serious Next.js middleware vulnerability months earlier.1 I didn’t immediately connect it to the challenge, but once it came back to me, everything suddenly made sense.
The exploit worked.
It was one of those moments where you stare at the screen for a second wondering, “Wait… did that actually work?”
That single solve was worth 200 points and immediately pushed us several places up the leaderboard.
Looking back, the interesting part wasn’t that I solved a cybersecurity challenge.
It was why I solved it.
The challenge wasn’t asking me to invent some clever exploit from scratch. It rewarded recognizing how a web framework actually worked, remembering a real vulnerability, and knowing enough about the framework to try it.
That’s software engineering knowledge.
People often treat cybersecurity and software engineering as completely separate fields. I don’t really buy that. Good web developers naturally pick up security concepts because they’re working with authentication, routing, sessions, middleware, APIs, and browser behavior every day.
Sometimes watching a random YouTube video about your framework turns out to be surprisingly useful months later.
This CTF reminded me that learning is rarely wasted. Even if you’re not trying to become a security engineer, understanding the tools you build with pays off in unexpected places.
For me, that happened to be enough to help our team finish as 1st Runner-Up in my very first CTF.
1st Runner-Up for Team Category out of 11 teams (830 points).
2nd Runner-Up for Individual Category (480 points).
The challenge involved exploiting a critical Next.js middleware authorization bypass (CVE-2025-29927). See the official advisory for more details.