Flag identifiers give you the needed information to locate a particular flag on a team's service. For example, if the scorebot placed a flag on the mary user's billing details, the flag identifier for that service might be the username, so you would recieve the flag identifier mary. The application would then have information on mary's profile.php page that contains a flag. If you logged into the mary user and viewed your own authenticated profile.php page, you would see the flag associated with the flag identifier mary.

Let's assume there's an exploit that allows you to view any webpage as any user with the /view_page_as endpoint. To exploit this for the mary user, our command might look something like curl http://boxes.mctf.io:XXXX/view_page_as?url=profile.php&user=mary, which would return mary's billing information, and thus the flag. When we're automating attacks against the many teams with the many flag_ids, we'll want to automate this process, so our new exploit might put the flag identifier into a variable, before calling somethine like curl http://boxes.mctf.io:$PORT/view_page_as?url=profile.php&user=$FLAG_IDENTIFIER. In short, flag identifiers prevent you from having to enumerate all of the data on an application to find the flags.

Contractual

Flag identifier: {"email": user_email, "contract_id": contract_id}

Flag location: Contract Text

Mainframe

Flag identifier: customer:username OR employee:username

Flag location: Confidential Claim OR Secret Internal Note

Brightside

Flag identifier: email

Flag location: Medical History