Capture the flag web application