AcmeCorp's server 'only runs a website' — or so they claim. Scan every port, fingerprint every service, and find the flag hidden in an exposed banner or file.