https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/ Recent content in Web on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/beyond-the-homepage/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/beyond-the-homepage/ Flag hidden in an HTML comment, visible only via browser developer tools or view-source. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-1/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-1/ IDOR / broken access control lets you access another user’s flag by changing an ID parameter. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-2/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-2/ Part 2 of the Boro Senpai series: SSRF via Docker internal hostname. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-3/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/boro-senpai-3/ Flag or unlock parameter hardcoded in client-side JavaScript. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/borogpt/ Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/cracking-the-vault/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/cracking-the-vault/ Password and flag hardcoded in client-side JavaScript — just read the source. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/dotdotslashflagtxt/ Classic path traversal — the challenge name tells you exactly what to do. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/drone-dash/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/drone-dash/ Node.js prototype pollution via POST /api/flight-profile grants admin access. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/kobenis-dashboard/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/kobenis-dashboard/ Abusing ImageMagick’s SVG text: pseudo-coder to read the flag file via server-side image conversion. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/neural-sync-portal/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/neural-sync-portal/ SSRF via Docker internal hostname to reach the metadata service and retrieve the flag. https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Tue, 16 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/boroctf-2026/web/solarity/ Path traversal via /view?file=../flag.txt reads the server-side flag file.