[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_154":155,"_156":150},"routes/_root/_root",{"_152":-7,"_40":59,"_132":-7,"_153":-7},"routes/_root.challenges",{"_36":148,"_149":150,"_151":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_63":64,"_65":66,"_67":68},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26],"name","Free Coupon","canonicalName","free-coupon",{"_27":55,"_29":56,"_31":57,"_33":16,"_34":16,"_35":16,"_36":37,"_38":58,"_40":59,"_42":16,"_43":60},{"_27":47,"_29":48,"_31":49,"_33":16,"_34":16,"_35":16,"_36":50,"_38":51,"_40":41,"_42":16,"_43":52},{"_27":28,"_29":30,"_31":32,"_33":16,"_34":16,"_35":16,"_36":37,"_38":39,"_40":41,"_42":16,"_43":44},"author",{"_20":45,"_46":-5},"writeupElementId","31468583","writeupId","31468583-74aa-48e2-a688-d66bcdf7669e","canEdit","canLike","likedByViewer","title","Writeup for Free Coupon","url","https://github.com/baumroll0928-spec/myRepository/tree/main/DailyAlpacaHack/p20260317_Free_Coupon","language","ja","isOfficial","createdAt",["D",1773778461767],"baumroll1234","gravatarHash",{"_20":53,"_46":54},"292878a1","292878a1-e71b-47e2-84c7-befa2d74d844","Writeup for Daily AlpacaHack 3/15-3/21","https://www.notion.so/kakur41-wrteup/Daily-AlpacaHack-3-15-3-21-32bda8520c0280008c6fdf4ada33eb29?source=copy_link",["D",1774151299097],"kakur41","b38a5e77015b23df77d112279a16aaba1c929e984106792bf5505dff367d67fa",{"_20":61,"_46":62},"c3b5dc10","c3b5dc10-b4c8-4341-af7b-185e98b07099","https://github.com/tepel-chen/My-CTF-Challs/tree/main/Daily%20AlpacaHack/Free%20Coupon","en",["D",1774863004705],"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","challenge",{"_20":21,"_22":23,"_72":73,"_74":75,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":87,"_88":16,"_89":-7,"_90":91,"_92":-7,"_93":-7,"_35":16,"_94":95,"_96":97,"_98":16,"_99":-7,"_100":16,"_101":-7,"_102":-7,"_103":104,"_105":-7,"_106":-7,"_107":-7,"_108":109,"_110":16,"_111":109,"_34":109,"_112":-7,"_113":114,"_115":116,"_117":118,"_119":120},"availablePages",[69,70,71],"canonicalUrl","https://alpacahack.com/challenges/free-coupon","Description","Solves","Writeups","solves",151,"difficulty",40,"flagFormat","Alpaca{...}","categories",[145],"attachments",[141],"remote",{"_138":139,"_140":109},"description","Get a free coupon now and buy the flag at a discount!\n

Beginner Hint 1: Overview of the problem (AI-translated)

\n\n- When you access the page, a random session ID (`sid`) is assigned.\n- When you access the `/buy` page, if the balance associated with the session ID is 30 or more, you can \"purchase\" and view the flag.\n- The initial balance is 0, but accessing the `/redeem` page allows you to get 10 balance in exchange for a coupon. However, after that, the `redeemed` flag becomes `true`, and it looks like you can't use the coupon multiple times.\n- There is no way to increase the balance other than coupons.\n\n

\n\n

Beginner Hint 2: Approach to the problem

\n\n- The implementation of `/redeem` is a bit unnatural. It takes a few seconds to get the coupon when accessed, but can we exploit this specification?\n\n

\n","descriptionJa","今すぐ無料クーポンを手に入れて、割引価格でフラグを買おう！\n

初心者向けヒント1: この問題の概要

\n\n- ページにアクセスするとランダムなセッションID(`sid`)が割り当てられます。\n- `/buy`のページアクセスしたときに、セッションIDに紐づいた残高(`balance`)が30以上であればフラグを「購入」して見ることができます。\n- 残高の初期値は0ですが、`/redeem`のページにアクセスするとクーポンと引き換えに10の残高を得ることができます。しかし、その後に`redeemed`というフラグが`true`になってしまい、複数回クーポンを利用できないようになっていそうです。\n- クーポン以外に残高を増やす方法はありません。\n\n

\n\n

初心者向けヒント2: 問題へのアプローチ

\n\n- `/redeem`の実装は少し不自然です。アクセスすると数秒掛けてクーポンを取得するようですが、この仕様の隙をつくことはできないでしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[137],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[134],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_121":122,"_103":104,"_123":124,"_125":126,"_127":128,"_129":130},"nextDailyCanonical","ppppparse","httpsProxyHostname","free-coupon.chal.alp4ca.com","program",{"_22":114,"_20":131,"_132":133},"scheduledDate",["D",1773673200000],"releaseAt",["D",1773673200000],"status","PUBLISHED","plannedTopic","General","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":135,"_22":136},"Race Condition","race-condition",{"_20":61,"_46":62},"instances",[],"canSpawn",{"_142":143,"_38":144},"fileName","free-coupon.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/af32a421-feda-4d9a-aa79-37a87092add5/free-coupon.tar.gz",{"_20":146,"_22":147},"Web","web","Challenges","query","","isLoggedIn","user","timeZoneAbbr","clientConfig",{"_157":158,"_159":109,"_160":161,"_162":161,"_163":164,"_165":166,"_167":16,"_168":150},"cspNonce","firebaseOptions",{"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":164},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]