[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_152":153,"_154":148},"routes/_root/_root",{"_150":-7,"_40":59,"_130":-7,"_151":-7},"routes/_root.challenges",{"_36":146,"_147":148,"_149":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_63":64,"_65":66,"_67":68},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26],"name","Free Coupon","canonicalName","free-coupon",{"_27":55,"_29":56,"_31":57,"_33":16,"_34":16,"_35":16,"_36":37,"_38":58,"_40":59,"_42":16,"_43":60},{"_27":47,"_29":48,"_31":49,"_33":16,"_34":16,"_35":16,"_36":50,"_38":51,"_40":41,"_42":16,"_43":52},{"_27":28,"_29":30,"_31":32,"_33":16,"_34":16,"_35":16,"_36":37,"_38":39,"_40":41,"_42":16,"_43":44},"author",{"_20":45,"_46":-5},"writeupElementId","31468583","writeupId","31468583-74aa-48e2-a688-d66bcdf7669e","canEdit","canLike","likedByViewer","title","Writeup for Free Coupon","url","https://github.com/baumroll0928-spec/myRepository/tree/main/DailyAlpacaHack/p20260317_Free_Coupon","language","ja","isOfficial","createdAt",["D",1773778461767],"baumroll1234","gravatarHash",{"_20":53,"_46":54},"292878a1","292878a1-e71b-47e2-84c7-befa2d74d844","Writeup for Daily AlpacaHack 3/15-3/21","https://www.notion.so/kakur41-wrteup/Daily-AlpacaHack-3-15-3-21-32bda8520c0280008c6fdf4ada33eb29?source=copy_link",["D",1774151299097],"kakur41","b38a5e77015b23df77d112279a16aaba1c929e984106792bf5505dff367d67fa",{"_20":61,"_46":62},"c3b5dc10","c3b5dc10-b4c8-4341-af7b-185e98b07099","https://github.com/tepel-chen/My-CTF-Challs/tree/main/Daily%20AlpacaHack/Free%20Coupon","en",["D",1774863004705],"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","challenge",{"_20":21,"_22":23,"_72":73,"_74":75,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":16,"_87":-7,"_88":89,"_90":-7,"_91":-7,"_35":16,"_92":93,"_94":95,"_96":16,"_97":-7,"_98":16,"_99":-7,"_100":-7,"_101":102,"_103":-7,"_104":-7,"_105":-7,"_106":107,"_108":16,"_109":107,"_34":107,"_110":-7,"_111":112,"_113":114,"_115":116,"_117":118},"availablePages",[69,70,71],"canonicalUrl","https://alpacahack.com/challenges/free-coupon","Description","Solves","Writeups","solves",146,"flagFormat","Alpaca{...}","categories",[143],"attachments",[139],"remote",{"_136":137,"_138":107},"description","Get a free coupon now and buy the flag at a discount!\n

Beginner Hint 1: Overview of the problem (AI-translated)

\n\n- When you access the page, a random session ID (`sid`) is assigned.\n- When you access the `/buy` page, if the balance associated with the session ID is 30 or more, you can \"purchase\" and view the flag.\n- The initial balance is 0, but accessing the `/redeem` page allows you to get 10 balance in exchange for a coupon. However, after that, the `redeemed` flag becomes `true`, and it looks like you can't use the coupon multiple times.\n- There is no way to increase the balance other than coupons.\n\n

\n\n

Beginner Hint 2: Approach to the problem

\n\n- The implementation of `/redeem` is a bit unnatural. It takes a few seconds to get the coupon when accessed, but can we exploit this specification?\n\n

\n","descriptionJa","今すぐ無料クーポンを手に入れて、割引価格でフラグを買おう！\n

初心者向けヒント1: この問題の概要

\n\n- ページにアクセスするとランダムなセッションID(`sid`)が割り当てられます。\n- `/buy`のページアクセスしたときに、セッションIDに紐づいた残高(`balance`)が30以上であればフラグを「購入」して見ることができます。\n- 残高の初期値は0ですが、`/redeem`のページにアクセスするとクーポンと引き換えに10の残高を得ることができます。しかし、その後に`redeemed`というフラグが`true`になってしまい、複数回クーポンを利用できないようになっていそうです。\n- クーポン以外に残高を増やす方法はありません。\n\n

\n\n

初心者向けヒント2: 問題へのアプローチ

\n\n- `/redeem`の実装は少し不自然です。アクセスすると数秒掛けてクーポンを取得するようですが、この仕様の隙をつくことはできないでしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[135],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[132],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_119":120,"_101":102,"_121":122,"_123":124,"_125":126,"_127":128},"nextDailyCanonical","ppppparse","httpsProxyHostname","free-coupon.chal.alp4ca.com","program",{"_22":112,"_20":129,"_130":131},"scheduledDate",["D",1773673200000],"releaseAt",["D",1773673200000],"status","PUBLISHED","plannedTopic","General","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":133,"_22":134},"Race Condition","race-condition",{"_20":61,"_46":62},"instances",[],"canSpawn",{"_140":141,"_38":142},"fileName","free-coupon.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/af32a421-feda-4d9a-aa79-37a87092add5/free-coupon.tar.gz",{"_20":144,"_22":145},"Web","web","Challenges","query","","isLoggedIn","user","timeZoneAbbr","clientConfig",{"_155":156,"_157":107,"_158":159,"_160":159,"_161":162,"_163":164,"_165":16,"_166":148},"cspNonce","firebaseOptions",{"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":162},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]