Online Over-Sharer — broncoctf2026

Description

Jenna loves her dog and has created an Instagram account to showcase their bond. Can you utilize her online activity to answer some capcha questions?

Target: https://broncoctf-online-over-sharer.chals.io/

Three provided PNG files were Instagram post screenshots from the account jenna_and_blue (Jenna and her basset hound, Blue). The site is a fake "Instagram Login" page that runs a two-stage identity-verification "capcha". The goal is to answer all questions correctly using OSINT harvested from Jenna's public posts, cross-referenced with pop-culture and campus knowledge.

Analysis

The artifacts

The provided download links (broncoctf.ctfd.io/files/...) first returned an HTML redirect; following it with curl -L yielded the real PNGs — 1125x2436 iPhone screenshots of three Instagram posts from jenna_and_blue:

• Post 2 — photo of the dog Blue; caption "guys Blue is so sad I'm going back to college :( Little does she know I graduate soon! #Bluesclues #classof2026 #gobroncos ...".
• Post 1 — an elevated ("aerial") view of Santa Clara University campus with a large palm tree, taken looking out from a high building. A tan Mission-Revival building with a square tower is prominently in frame. Caption: "As great as this view of campus is, I'm missing Blue so much right now ... I'll be home again in June ... #2026".
• Post 3 — puppy photo (dated 5/18/2018) with a numbered fun-facts list:
  1. "Blue is a basset hound which is the same as Blue from Blue's Clues (my fave show as a kid #bluesclues)"
  2. "... Now she's 8 years old!"
  3. "Blue has 2 brothers ..."
  4. "Blue is gonna watch my graduation in June from grandmas house lol #classof2026"
  5. "..."

The target app

The site is an Express (Node.js) app. Entering a username opens a Stage 1 verification modal (POST /check1), then a Stage 2 modal (POST /check2). The page HTML/JS (index.html) revealed the field names and the fetch calls. Key properties, confirmed by probing:

• Both endpoints are stateless JSON — no cookies/session, and /check2 does not depend on /check1.
• /check1 requires the correct username jenna_and_blue (else "Wrong username."), otherwise "Incorrect. Are you really Jenna?", and "ok" on success.
• The matcher is case-insensitive, whitespace-trimmed, and accepts synonyms (e.g. "BASSET HOUND", " basset hound ", "6/2026", "06/2026", "2", "two" all pass) but is not a substring match ("my basset hound blue" fails).
• /check2 returns "Verified as jenna_and_blue!\n<flag>" on success, or "Incorrect. Suspicious..." (HTTP 401) on any failure.

The all-or-nothing failure message on a stateless endpoint means you can fix the fields you're sure of and brute-force the one you're not.

Solution

Stage 1 (POST /check1) — straight OSINT from the captions

Field	Answer	Source
firstDogBreed	basset hound	Post 3 fact #1
gradDate (mm/yyyy)	06/2026	June + #classof2026
dogSiblings	2	Post 3 fact #3: "Blue has 2 brothers"

Payload → "ok".

Stage 2 (POST /check2) — trivia + geolocation

• voiceActor — "Who's the original voice actor of a pink friend in your favorite childhood TV show?" Favorite show = Blue's Clues. The pink friend is Magenta (Blue's best friend). The original-series voice actor is Koyalee Chanda (Wikipedia "List of Blue's Clues characters", Behind The Voice Actors / TV Tropes). ⚠️ The reboot voice is Diane Salema — the question explicitly asks for the original.
• watchFrom — "Where will your dog be watching your graduation from?" → grandmas house (Post 3 fact #4).
• building — "What building gives your favorite view of SCU's campus?" The trap here: intuition says Swig Hall (SCU's tall 11-story dorm famously advertised for "great views of campus") — but that answer is rejected. The correct answer is Kenna Hall, the tan Mission-Revival building with the square tower actually visible in Post 1's campus photo.

Resolving the building with a brute force

Since /check2 is stateless and returns a single all-or-nothing message, I fixed watchFrom + voiceActor and brute-forced the SCU building list against /check2 (brute_building.py). It hit on "Kenna Hall".

#!/usr/bin/env python3
import requests

URL = "https://broncoctf-online-over-sharer.chals.io/check2"

# SCU building candidate list (dorms, halls, landmarks)
buildings = [
    "Swig Hall", "Kenna Hall", "Nobili Hall", "Graham Hall", "Dunne Hall",
    "McLaughlin Hall", "Walsh Hall", "Campisi Hall", "Sanfilippo Hall",
    "Casa Italiana", "Sobrato Hall", "Bergin Hall", "Benson Center",
    "Mission Church", "de Saisset Museum", "Learning Commons",
    "Vari Hall", "O'Connor Hall", "St. Joseph's Hall",
]

base = {
    "username": "jenna_and_blue",
    "watchFrom": "grandmas house",
    "voiceActor": "Koyalee Chanda",
}

for b in buildings:
    payload = dict(base, building=b)
    r = requests.post(URL, json=payload)
    print(f"[{r.status_code}] {b!r} -> {r.text.strip()!r}")
    if r.status_code == 200 or "Verified" in r.text:
        print("\n[+] WINNER:", b)
        print(r.text)
        break

Final winning request

POST https://broncoctf-online-over-sharer.chals.io/check2
Content-Type: application/json

{"username":"jenna_and_blue","building":"Kenna Hall","watchFrom":"grandmas house","voiceActor":"Koyalee Chanda"}

Response:

Verified as jenna_and_blue!
bronco{REDACTED}