$ cat writeup.md…
$ cat writeup.md…
broncoctf2026
Task: OSINT+web hybrid — reconstruct answers to identity-verification 'capcha' questions from a target's Instagram over-sharing (3 post screenshots) against a stateless Express app. Solution: mine captions/hashtags for dog breed, grad date and sibling count; cross-reference Blue's Clues trivia for the Magenta voice actor; identify SCU's Kenna Hall in a campus photo; brute-force the one ambiguous building field on the lenient stateless /check2 endpoint.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Jenna loves her dog and has created an Instagram account to showcase their bond. Can you utilize her online activity to answer some capcha questions?
Target: https://broncoctf-online-over-sharer.chals.io/
Three provided PNG files were Instagram post screenshots from the account jenna_and_blue (Jenna and her basset hound, Blue). The site is a fake "Instagram Login" page that runs a two-stage identity-verification "capcha". The goal is to answer all questions correctly using OSINT harvested from Jenna's public posts, cross-referenced with pop-culture and campus knowledge.
The provided download links (broncoctf.ctfd.io/files/...) first returned an HTML redirect; following it with curl -L yielded the real PNGs — 1125x2436 iPhone screenshots of three Instagram posts from jenna_and_blue:
...
$ grep --similar