My first CTF was won with web dev knowledge

Hack4Gov was my first Capture-The-Flag competition. Honestly, I only joined because my friends convinced me to (with a bit of FOMO). I don’t actively study cybersecurity and it’s not where I want to build my career, my experience has always been in web development. That ended up mattering more than I expected.

I spent almost the entire competition on web challenges.

I solved two web exploitation problems early, then hit a wall for hours. Nothing worked. I switched challenges, helped with OSINT, took breaks, came back, still nowhere.

Eventually I returned to a web challenge involving Next.js middleware and kept trying ideas until one clicked: a video from Theo about a serious Next.js middleware vulnerability months earlier.¹ I didn’t connect it to the challenge right away, but once it came back to me, everything made sense. The exploit worked, one of those moments where you stare at the screen wondering “wait, did that actually work?” That single solve was worth 200 points and pushed us several places up the leaderboard.

Looking back, the interesting part wasn’t that I solved a cybersecurity challenge. It was why I solved it. It didn’t ask me to invent some clever exploit from scratch. It rewarded recognizing how a web framework actually worked and remembering a real vulnerability. That’s software engineering knowledge. People treat cybersecurity and software engineering as separate fields, but I don’t buy that. Good web developers pick up security concepts naturally, since they work with auth, routing, sessions, middleware, and browser behavior every day. Sometimes a random YouTube video about your framework turns out to be useful months later.

That was enough to help our team finish 1st Runner-Up in my very first CTF.