The original title is "BroncoCTF : The KeyMaster Writeup"

Short summary

A detailed CTF writeup for the KeyMaster challenge from BroncoCTF, where the flag was split across eight fragments hidden throughout a Next.js website. Four fragments were found in static HTML, one in a linked text file, and three were embedded in client-side JavaScript bundles behind onClick handlers, cookie assignments, and dynamically injected HTML comments. The key lesson is that modern JS-framework sites hide significant content behind client-side hydration logic invisible to curl.

• •Flag was split into 8 fragments hidden across static HTML, linked files, and client-side JS bundles
• •Half the fragments were invisible to curl and required downloading and grepping Next.js chunk files
• •Minified React source remains greppable for onClick handlers, string literals, and JSX attributes

Generated with AI, which can make mistakes.