Beyond the Homepage
Flag hidden in an HTML comment, visible only via browser developer tools or view-source.
Web
Web exploitation challenges from boroCTF 2026.
No writeups match your filter.
Boro Senpai 1
IDOR / broken access control lets you access another user’s flag by changing an ID parameter.
Boro Senpai 2
Part 2 of the Boro Senpai series: SSRF via Docker internal hostname.
Boro Senpai 3
Flag or unlock parameter hardcoded in client-side JavaScript.
boroGPT
Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE.
Cracking the Vault
Password and flag hardcoded in client-side JavaScript — just read the source.
dotdotslashflagtxt
Classic path traversal — the challenge name tells you exactly what to do.
Drone Dash
Node.js prototype pollution via POST /api/flight-profile grants admin access.
Kobeni's Dashboard
Abusing ImageMagick’s SVG text: pseudo-coder to read the flag file via server-side image conversion.
Neural Sync Portal
SSRF via Docker internal hostname to reach the metadata service and retrieve the flag.