Boro Senpai 3

Challenge

Part 3 of the Boro Senpai series. A locked page requires a special parameter to unlock content.

Approach

1. View the page source / JS bundle.
2. Find a hardcoded mod parameter or password in the JavaScript:

1
2
3

if (params.get("mod") === "boro_admin_unlock_9x") {
    showFlag("boroCTF{th@nk_y0u_y0u_d!d_w3ll_!_l0v3_y0U<3}");
}

3. Navigate to /?mod=boro_admin_unlock_9x to reveal the flag.

Flag

boroCTF{th@nk_y0u_y0u_d!d_w3ll_!_l0v3_y0U<3}