Writeups from Day 1 of SRCTF 2026, held on 15/08/2026
Challenges
- Welcome Home - flag hidden in an HTML comment on the homepage
- Hidden Secrets - directory bruteforcing uncovers the unlisted /about/ page containing the flag
- Robot Rock - robots.txt discloses a hidden staging page containing the flag
- Patient Zero - client-controlled isLicensed parameter allows registration of accounts with invalid medical licenses
- What’s Up Doc? - IDOR that lets you take over any doctor account
- Help Desk - SQL injection in the unauthenticated help search leaks the flag from system_config via UNION
- Death by LaTeX - LaTeX filter bypass that reads the server logs