AlpacaHack Logo

Challenges

Sign InSign Up

Rows:

CHALLENGEAUTHORS

SOLVES

(CURRENT)

SOLVE RATE

(AT CONTEST TIME)

AlpacaHack 2100

Daily AlpacaHack

admin

1768

solves

-

1575

solves

-

Daily AlpacaHack

938

solves

-

AlpacaHack Round 2 (Web)

630

solves

Top 28%

= 84/300 users

Daily AlpacaHack

626

solves

-

Daily AlpacaHack

609

solves

-

SECCON Beginners CTF 2024

546

solves

Top 73%

= 683/928 teams

Daily AlpacaHack

411

solves

-

Daily AlpacaHack

410

solves

-

Daily AlpacaHack

377

solves

-

Daily AlpacaHack

368

solves

-

echo

AlpacaHack Round 1 (Pwn)

363

solves

Top 32%

= 56/174 users

Daily AlpacaHack

351

solves

-

Daily AlpacaHack

342

solves

-

Daily AlpacaHack

341

solves

-

Daily AlpacaHack

333

solves

-

Encoding Basics

Daily AlpacaHack

332

solves

-

🐈

Daily AlpacaHack

324

solves

-

Bars

Daily AlpacaHack

319

solves

-

108

Daily AlpacaHack

307

solves

-

Rows:

Another Login Challenge

Daily AlpacaHackTopic: LoginReleased: Mar 13, 2026

137 solves
Web
Medium

by

tchen

tchen

Login, login, and login!

Beginner Hint 1 (AI-translated)
  • In index.js, a simple login feature is implemented.

  • It appears to check that users[username] exists and that users[username].password matches the provided password.

  • It doesn’t seem possible to create your own user. Also, a user called admin is registered, but guessing that password would be impossible.

Beginner Hint 2 (AI-translated)
  • In JavaScript, users["foobar"] and users.foobar are almost equivalent. Could this be used somehow?
  • The login form alone might not allow you to send the intended data. For methods of sending data without using a browser, refer to my writeup for I wanna be the Admin.
another-login-challenge.tar.gz
descriptionsolveswriteups