1. In the in-page viewer (or Wireshark), note repeated requests to the same host cdn-sync.evil.test at a fixed interval — a beacon. Why: automated C2 implants call home on regular timers, unlike human browsing.
2. Each beacon carries a ?d=<base64> parameter. Concatenate/collect the d values and base64-decode — the decoded data is the flag.
3. The page provides a base64 decoder; paste the value.
Lesson: hunt for periodicity + repeated destinations + encoded parameters.