The Keymaster — broncoctf2026

Description

The Keymaster has split a flag into 8 keys and hid them in plain sight. Quite literally, as they're on our advertisement page! Ready your cursor-pointers, pull out your trusty inspection panel, and find them quickly, detective!

Target: https://broncosec.com/BroncoCTF

English summary: The flag is split into 8 numbered fragments (each prefixed 1 - , 2 - , ... 8 - ) hidden "in plain sight" across a marketing/landing page. The goal is client-side reconnaissance: find all 8 fragments in the HTML, bundled JavaScript, cookies, element attributes, HTML comments, and a standalone file, then concatenate them in numeric order.

Analysis

The site is a Next.js (Turbopack) static app served from GitHub Pages. The wording of the description is a direct set of instructions:

• "hid them in plain sight" → the data is in the client-delivered page, not the server.
• "Ready your cursor-pointers" → some fragments are exposed via onClick/hover interactions (cursor: pointer elements).
• "pull out your trusty inspection panel" → use browser DevTools (Elements, Application/Cookies, Sources).

Because it is a static Next.js app, all interactive logic and hidden strings live in static JS chunks under /_next/static/chunks/. The single most useful chunk (e785679bf8074938.js) contains most interactive fragments (2, 4, 5, 6, 8) and their object definitions.

Recon method:

• Fetch the main HTML and the RSC payload.
• Fetch each JS chunk and grep/ripgrep for the patterns [1-8] -, KEY, cursor-pointer, onClick.
• Inspect cookies via DevTools → Application → Cookies.
• Hover links / read title and alt attributes.
• Fetch the standalone /7.txt.
• (robots.txt returned 404 — not relevant.)

Solution

Each of the 8 fragments is prefixed with its ordinal (N - ) to make ordering unambiguous. Here is where each was found:

#	Fragment	Location	How to find it
1	bronco{h	Footer HTML (page source), near credit "Art by Anni L. '28"	Present in raw HTML / Next.js RSC payload as 1 - bronco{h
2	3y_y0u_f	onClick handler on the word "flags" in the "About the Competition" paragraph	JS chunk e785679bf8074938.js: e.firstChild.textContent+="2 - 3y_y0u_f" (also plays ding.oga)
3	0und_th3	title attribute of the "Join the Competition" registration link	<a title="3 - 0und_th3" href="https://broncoctf.ctfd.io/"> — visible on hover / in source
4	m_4ll_w1	Cookie set by the emoji (🙋) onClick under "Prize Pool"	document.cookie="KEY4=4 - m_4ll_w1; path=/" → DevTools Application → Cookies (KEY4); also plays puzzle.oga
5	th_4b501	Generated HTML comment near the SANS sponsor logo	React component sets outerHTML to <!-- 5 - th_4b501 --> (source: comment:"!!! 5 - th_4b501 !!!")
6	ut31y_n0	"BroncoCTF 2026...?" past-repositories hover-card link	href:"/BroncoCTF?KEY=6-ut31y_n0"
7	_w0rr135	Content of /7.txt (linked from the "2026" download link)	curl https://broncosec.com/7.txt → 7 - _w0rr135
8	_4t_411}	title/alt of the last statistics number card (correct-flag-colorized.svg)	Rendered as alt="8 - _4t_411}"; source object {title:"8 - _4t_411}", ...}

Fast recon commands

# 1. Grab main page + RSC payload, look for fragment prefixes
curl -s https://broncosec.com/BroncoCTF | rg -o '[1-8] - [^"<]+'

# 2. Enumerate and grep the JS chunks
curl -s https://broncosec.com/BroncoCTF \
  | rg -o '/_next/static/chunks/[a-f0-9]+\.js' | sort -u \
  | while read c; do
      curl -s "https://broncosec.com$c" \
        | rg -o '[1-8][ -]+[^"]{4,12}|KEY[0-9]?=?[0-9] ?- ?[^";]+'
    done

# 3. The standalone file for fragment 7
curl -s https://broncosec.com/7.txt

# 4. Cookie fragment (KEY4) — set by an onClick, so read from JS chunk
#    or trigger the 🙋 click in a browser and read DevTools > Cookies.

Assemble

Concatenate fragments 1..8 in numeric order:

h + 3y_y0u_f + 0und_th3 + m_4ll_w1 + th_4b501 + ut31y_n0 + _w0rr135 + _4t_411}

1 already contains the bronco{ prefix and 8 contains the closing }. Reading the plaintext: "hey you found them all with absolutely no worries at all."