[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_139":140,"_141":134},"routes/_root/_root",{"_136":-7,"_38":137,"_115":-7,"_138":-7},"routes/_root.challenges",{"_34":132,"_133":134,"_135":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_45":46,"_47":48,"_49":50},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24],"name","List Sharing","canonicalName","list-sharing",{"_25":26,"_27":28,"_29":30,"_31":16,"_32":16,"_33":16,"_34":35,"_36":37,"_38":39,"_40":16,"_41":42},"author",{"_20":43,"_44":-5},"writeupElementId","3a021740","writeupId","3a021740-db82-46e9-b411-737c9eea0f80","canEdit","canLike","likedByViewer","title","Writeup for List Sharing","url","https://github.com/baumroll0928-spec/myRepository/tree/main/Daily_AlpacaHack/m202608/d16-17_List_Sharing","language","ja","isOfficial","createdAt",["D",1786999478157],"baumroll1234","gravatarHash","challenge",{"_20":21,"_22":23,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":16,"_71":-7,"_72":73,"_74":-7,"_75":-7,"_33":16,"_76":77,"_78":79,"_80":16,"_81":-7,"_82":16,"_83":-7,"_84":-7,"_85":86,"_87":-7,"_88":-7,"_89":-7,"_90":91,"_92":16,"_93":91,"_32":91,"_94":16,"_95":-7,"_96":97,"_98":99,"_100":101,"_102":103},"availablePages",[51,52,53],"canonicalUrl","https://alpacahack.com/challenges/list-sharing","Description","Solves","Writeups","solves",79,"difficulty",55,"flagFormat","Alpaca{...}","categories",[129],"attachments",[125],"remote",{"_122":123,"_124":91},"description","Sharing is caring\n

Beginner Hint: About the Admin Bot

\n\n- In this challenge, you are given not only the web application itself, but also an admin bot.\n- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.\n- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.\n- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.\n- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) and read its writeup.\n\n

Beginner Hint: How to approach

\n\n- `script` tags are not filtered, but they do not work in this challenge. When HTML is inserted using `innerHTML`, the browser does not execute any `script` tags in it.\n- You may want to use event attributes such as `onload` or `onerror` to trigger your payload. Can you use them without any whitespace characters?\n

\n","descriptionJa","共有は思いやりです\n

Beginner Hint: Admin Botについて

\n\n- この問題では、Webアプリ本体とは別に Admin Bot が用意されています。\n- Admin Bot はフラグ入りのCookieを持った状態で、指定されたパスを Headless Chrome で開きます。\n- そのため、目標は「Admin Bot に自分の用意したペイロードを踏ませて、Cookieの内容を外部へ送らせること」です。\n- 送信先は自分でサーバーを立ててもよいですし、HTTPリクエストを受け取って確認できる既存サービスを使っても構いません。\n- Admin Bot の使い方や、外部から受信したリクエストの確認方法がまだ曖昧なら、先に [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) を解いてWriteupを読むことをおすすめします。\n\n

Beginner Hint: 解き方の方針

\n\n- `script` タグはフィルタされていませんが、この問題では使えません。`innerHTML` で HTML が挿入された場合、ブラウザはその中の `script` タグを実行しません。\n- ペイロードを発火させるには、`onload` や `onerror` のようなイベント属性を使うとよいかもしれません。これらは空白文字なしで使えるでしょうか？\n

\n","descriptionRequiresSignIn","changeLog","authors",[119],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[117],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","showcaseMode","dailyProgramCanonicalForAction","reviewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_104":105,"_85":86,"_106":107,"_108":109,"_110":111,"_112":113},"nextDailyCanonical","wrong-instruction","httpsProxyHostname","list-sharing.chal.alp4ca.com","program",{"_22":97,"_20":114,"_115":116},"scheduledDate",["D",1786806000000],"releaseAt",["D",1786806000000],"status","PUBLISHED","plannedTopic","XSS","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":113,"_22":118},"xss",{"_20":120,"_44":121},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_126":127,"_36":128},"fileName","list-sharing.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/1dfece38-c605-4f19-acc4-15ac53f96f2f/list-sharing.tar.gz",{"_20":130,"_22":131},"Web","web","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_142":143,"_144":91,"_145":146,"_147":146,"_148":149,"_150":151,"_152":16,"_153":134},"cspNonce","firebaseOptions",{"_154":155,"_156":157,"_158":159,"_160":161,"_162":163,"_164":149},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]