Challenge
No file, no binary — just a URL:
https://broncosec.com/BroncoCTF
The flag format is given as bronco{XXXX...}. Nothing else. This is an
OSINT / web-recon style challenge: the flag is broken into 8 numbered
fragments, scattered across the live site using a mix of static HTML,
downloadable files, and client-side JavaScript behavior. The goal is to
find all 8 pieces and assemble them in order.
Recon
Fetching the page's rendered HTML directly gives a first look. Most of
the page is a fairly standard "CTF landing page" — hero banner, stats
counters, sponsor logo, footer credits. Scanning through it for anything
that looks out of place (odd alt text, title attributes, query
strings, filenames) turns up four fragments immediately, sitting in
plain sight in the static markup:
| # | Fragment | Location |
|---|---|---|
| 1 | bronco{h |
Plain text at the very end of the page footer, after the credits |
| 3 | 0und_th3 |
title attribute on the "Join the Competition" button/link |
| 6 | ut31y_n0 |
Query string on the "BroncoCTF 2026...?" repository card: href="/BroncoCTF?KEY=6-ut31y_n0"
|
| 8 | _4t_411} |
alt text on the sixth stats card (the one using correct-flag-colorized.svg) |
That's 4 of 8, found just by reading the rendered HTML carefully.
Piece 7 — a hidden download
The "About the Competition" text includes:
BroncoCTF 2026 will be our fifth CTF...
The word "2026" is a hyperlink to /7.txt, disguised as normal body
text (no obvious styling gives it away as a link in the rendered page).
Fetching it directly:
$ curl https://broncosec.com/7.txt
7 - _w0rr135
Piece 7 found.
Pieces 2, 4, 5 — hidden in client-side JavaScript
The remaining three fragments never appear in the static HTML at all —
they're generated at runtime by JavaScript event handlers, meaning a
plain curl/fetch of the page will never reveal them. The fix is to
pull down the site's actual JS bundles and grep them directly.
Step 1 — enumerate the script chunks. Looking at the <script src=...>
tags in the raw page source (Next.js app, so chunks are hashed filenames
under /_next/static/chunks/):
$ curl -sO https://broncosec.com/_next/static/chunks/e785679bf8074938.js
$ curl -sO https://broncosec.com/_next/static/chunks/f31cf569852813cb.js
... (and the rest of the referenced chunks)
Step 2 — grep for anything flag-shaped:
$