[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_163":164,"_165":158},"routes/_root/_root",{"_160":-7,"_41":161,"_135":-7,"_162":-7},"routes/_root.challenges",{"_37":156,"_157":158,"_159":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_68":69,"_70":71,"_72":73},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27],"name","Hello Programmer!","canonicalName","hello-programmer",{"_28":62,"_30":63,"_32":64,"_34":16,"_35":16,"_36":16,"_37":38,"_39":65,"_41":42,"_43":16,"_44":66},{"_28":55,"_30":56,"_32":57,"_34":16,"_35":16,"_36":16,"_37":58,"_39":59,"_41":42,"_43":16,"_44":60},{"_28":49,"_30":50,"_32":51,"_34":16,"_35":16,"_36":16,"_37":38,"_39":52,"_41":42,"_43":16,"_44":53},{"_28":29,"_30":31,"_32":33,"_34":16,"_35":16,"_36":16,"_37":38,"_39":40,"_41":42,"_43":16,"_44":45},"author",{"_20":46,"_47":48},"writeupElementId","981acc36","writeupId","981acc36-4da5-4dd1-9a57-486f6bb63cb6","canEdit","canLike","likedByViewer","title","Writeup for Hello Programmer!","url","https://github.com/tadanobutubutu/hello-programmer-solve/blob/main/README.md","language","ja","isOfficial","createdAt",["D",1779901100426],"tadanobutubutu","gravatarHash","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":54,"_47":-5},"60655f5e","60655f5e-b8f2-47ba-8e1e-33165c8dec2a","https://github.com/baumroll0928-spec/myRepository/tree/main/Daily_AlpacaHack/m202605/d27_Hello_Programmer",["D",1779899280884],"baumroll1234",{"_20":61,"_47":-5},"ed833c4e","ed833c4e-e26e-43a4-a13b-a8dafbee4ccb","Daily AlpacaHackに挑戦するつくよみちゃん 05/27/Hello Programmer!/tchen","https://www.nicovideo.jp/watch/sm46363778",["D",1779898806513],"tsukuyomi-chan",{"_20":67,"_47":-5},"33727824","33727824-027a-4645-8903-023b6fa415a6","https://github.com/goroshirow/CTF-WriteUps/tree/main/AlpacaHack/2026May/Hello%20Programmer!",["D",1779895232950],"goroshirow","challenge",{"_20":21,"_22":23,"_77":78,"_79":80,"_81":82,"_83":84,"_85":86,"_87":88,"_89":90,"_91":16,"_92":-7,"_93":94,"_95":-7,"_96":-7,"_36":16,"_97":98,"_99":100,"_101":16,"_102":-7,"_103":16,"_104":-7,"_105":-7,"_106":107,"_108":-7,"_109":-7,"_110":-7,"_111":112,"_113":16,"_114":112,"_35":112,"_115":-7,"_116":117,"_118":119,"_120":121,"_122":123},"availablePages",[74,75,76],"canonicalUrl","https://alpacahack.com/challenges/hello-programmer","Description","Solves","Writeups","solves",65,"flagFormat","Alpaca{...}","categories",[153],"attachments",[149],"remote",{"_146":147,"_148":112},"description","Greetings!\n

Beginner Hint1: About the Admin Bot

\n\n- In this challenge, you are given not only the web application itself, but also an admin bot.\n- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.\n- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.\n- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.\n- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) and read its writeup.\n\n

Beginner Hint2: Approach

\n\n- Nonce-based CSP relies on the assumption that the nonce value is unpredictable. Does this assumption hold in this challenge?\n\n

\n","descriptionJa","こんにちは！\n

Beginner Hint1: Admin Botについて

\n\n- この問題では、Webアプリ本体とは別に Admin Bot が用意されています。\n- Admin Bot はフラグ入りのCookieを持った状態で、指定されたパスを Headless Chrome で開きます。\n- そのため、目標は「Admin Bot に自分の用意したペイロードを踏ませて、Cookieの内容を外部へ送らせること」です。\n- 送信先は自分でサーバーを立ててもよいですし、HTTPリクエストを受け取って確認できる既存サービスを使っても構いません。\n- Admin Bot の使い方や、外部から受信したリクエストの確認方法がまだ曖昧なら、先に [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) を解いてWriteupを読むことをおすすめします。\n\n

Beginner Hint2: この問題のアプローチ

\n\n- nonceを元にしたCSPは、このnonceが予測不能であることが前提となっています。この問題では本当に予測不能でしょうか。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[143],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[137,138],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_124":125,"_106":107,"_126":127,"_128":129,"_130":131,"_132":133},"nextDailyCanonical","alpaca-form","httpsProxyHostname","hello-programmer.chal.alp4ca.com","program",{"_22":117,"_20":134,"_135":136},"scheduledDate",["D",1779807600000],"releaseAt",["D",1779807600000],"status","PUBLISHED","plannedTopic","CSP","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":141,"_22":142},{"_20":139,"_22":140},"XSS","xss","Content Security Policy","content-security-policy",{"_20":144,"_47":145},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_150":151,"_39":152},"fileName","hello-programmer.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/bccff2d1-783e-4d0d-9d52-05be91b78279/hello-programmer.tar.gz",{"_20":154,"_22":155},"Web","web","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_166":167,"_168":112,"_169":170,"_171":170,"_172":173,"_174":175,"_176":16,"_177":158},"cspNonce","firebaseOptions",{"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":173},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]