Flags picoCTF 2019 Solution

Published: April 2, 2026

Description

What do the flags mean? The image shows signal flags - decode them using the US Navy signal flag alphabet.

Download the image file.

bash
wget <url>/flag.png

Solution

Want to try it yourself first?

The guided walkthrough reveals hints one step at a time.

Walk me through it
  1. Step 1
    Open the image and identify the flag system
    Observation
    I noticed the challenge description explicitly mentioned 'signal flags' and referenced the US Navy signal flag alphabet, which pointed directly to opening the image and visually identifying the maritime flag system rather than running any binary analysis tools.
    Open flag.png. The image shows a series of maritime signal flags - the international code of signals used by the US Navy and merchant vessels. Each flag design corresponds to a letter. Search for a 'US Navy signal flags alphabet' reference chart.
    bash
    xdg-open flag.png
    What didn't work first

    Tried: Try to decode the flags using semaphore charts instead of maritime signal flags.

    Semaphore encodes letters by the angle of two handheld flags held by a person, not by the color pattern printed on a rectangular flag. Applying a semaphore chart to these maritime flags produces nonsense characters because the two systems are completely unrelated substitution ciphers. The correct reference is the International Code of Signals / US Navy signal flag alphabet, which maps each unique flag design to a letter or digit.

    Tried: Run strings or exiftool on flag.png looking for hidden text or metadata instead of decoding the visual flags.

    strings and exiftool inspect file metadata and raw byte sequences, not the visual content of the image. The encoded message is displayed as drawn flag graphics inside the image pixels, so no hidden ASCII strings or EXIF fields are present. The solve requires opening the image, visually identifying each maritime flag, and manually matching it to the reference alphabet chart.

    Learn more

    The International Code of Signals (ICS) uses a set of 26 lettered flags, 10 numeral pennants, and special flags. Each letter flag has a unique color pattern. The US Navy uses this system for visual ship-to-ship communication. This is distinct from semaphore (which uses a person holding two handheld flags at different angles).

    Note that the number flags in the US Navy system differ from the national/NATO version - the number flags differ from the international standard, so the US Navy chart must be used specifically.

  2. Step 2
    Look up the US Navy signal flag alphabet
    Observation
    I noticed the rabbithole warning that semaphore charts produce nonsense here, and the context note that the number flags specifically match the US Navy version rather than the international standard, which indicated that finding the correct reference chart was the critical step before any decoding could begin.
    Search for 'US Navy signal flags' or 'Navy signal flag alphabet' to find a reference chart showing the color pattern for each letter and number. Match each flag in the image to its corresponding character.
    Learn more

    Each flag in the ICS has a specific design: for example, Alpha is white and blue, Bravo is all red, Charlie is horizontal red-white-blue stripes. The numeric flags (0-9) are pendants (triangular) with different color patterns. Pay attention to whether the flags in the image are letter flags or number flags.

  3. Step 3
    Decode and submit the flag
    Observation
    I noticed that each flag in the image has a one-to-one correspondence to a letter or digit in the reference chart, so reading them left to right and concatenating the results produces the plaintext that just needs to be wrapped in the picoCTF{} format.
    Read each flag from left to right (or in sequence as shown). Concatenate the decoded letters/numbers. Wrap in picoCTF{...} to submit.
    Learn more

    Maritime signal flags are still used today by the US Navy and international shipping for visual communication when radio silence is required. The full ICS defines single-flag signals (letters) with standardized meanings (e.g., Alpha = diver down, Bravo = dangerous cargo), as well as multi-flag signals for longer messages.

Interactive tools
  • Cipher Identifier & Auto-DecoderPaste any ciphertext and the tool auto-runs every common decoder (base64, hex, Morse, ROT, Atbash, Bacon, binary, decimal, URL) and ranks the results by English-likeness.

Flag

Reveal flag

picoCTF{F1AG5AND5TUFF}

Decode using the US Navy signal flag alphabet (not semaphore) - each flag design represents a letter or number that spells the flag.

Key takeaway

Visual communication systems like maritime signal flags, semaphore, and Morse code are substitution ciphers where each symbol maps to a letter or digit according to a published standard. Recognizing which encoding system is in use, and locating the correct reference chart, is the entire challenge because the mapping is public and mechanical once identified. CTF challenges frequently present data encoded in obscure but real-world standards (flag alphabets, Braille, NATO phonetic, bar codes) to test whether solvers can identify and look up the system rather than trying to cryptanalyze it.

Related reading

Want more picoCTF 2019 writeups?

Tools used in this challenge

What to try next