Challenge

Part 1 of the Boro Senpai series. A profile page at /user?id=<your_id>.

Approach

  1. Log in and note your user ID in the URL: /user?id=1001.
  2. Change the ID to 1 (admin) or iterate to find the flag holder’s ID: /user?id=1.
  3. The server does not verify authorization — you can read any user’s profile including the flag field.
1

GET /user?id=1

Response contains the flag.

Flag

boroCTF{3l_psY_c0ngR00!}