BoroCTF-2026

A Basic Start

Decoding a multi-layer encoding chain: Base64 followed by Base91.

Reverse-engineering a custom esolang stack machine to recover the flag.

Reversing a Python marshal bytecode maze generator seeded by an LCG to find the escape path.

Finding the flag inside the Library of Babel using a seed and image residual pixel indices.

Flag hidden in an HTML comment, visible only via browser developer tools or view-source.

OSINT challenge: identify a Freehold High School alum from a blurred music photo — Bruce Springsteen.

IDOR / broken access control lets you access another user’s flag by changing an ID parameter.

Part 2 of the Boro Senpai series: SSRF via Docker internal hostname.

Flag or unlock parameter hardcoded in client-side JavaScript.

Source-map leak reveals JWT secret, forge admin token, then exploit Jinja2 SSTI for RCE.