[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_149":150,"_151":144},"routes/_root/_root",{"_146":-7,"_39":147,"_122":-7,"_148":-7},"routes/_root.challenges",{"_35":142,"_143":144,"_145":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_53":54,"_55":56,"_57":58},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25],"name","Nano Services","canonicalName","nano-services",{"_26":46,"_28":47,"_30":48,"_32":16,"_33":16,"_34":16,"_35":49,"_37":50,"_39":40,"_41":16,"_42":51},{"_26":27,"_28":29,"_30":31,"_32":16,"_33":16,"_34":16,"_35":36,"_37":38,"_39":40,"_41":16,"_42":43},"author",{"_20":44,"_45":-5},"writeupElementId","638d923b","writeupId","638d923b-5dc5-457b-a315-0147e58e186b","canEdit","canLike","likedByViewer","title","Daily AlpacaHackに挑戦するつくよみちゃん06/29/Nano Services/tchen","url","https://youtu.be/Lb4FxbqmC6k","language","ja","isOfficial","createdAt",["D",1782751324423],"tsukuyomi-chan","gravatarHash",{"_20":52,"_45":-5},"62725ee5","62725ee5-4378-495c-95ac-f3aa5a2df402","Writeup for Nano Services","https://note.com/aiueo6614/n/nfe038c9d47a3",["D",1782814236801],"aiueo6614","challenge",{"_20":21,"_22":23,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":16,"_79":-7,"_80":81,"_82":-7,"_83":-7,"_34":16,"_84":85,"_86":87,"_88":16,"_89":-7,"_90":16,"_91":-7,"_92":-7,"_93":94,"_95":-7,"_96":-7,"_97":-7,"_98":99,"_100":16,"_101":99,"_33":99,"_102":-7,"_103":104,"_105":106,"_107":108,"_109":110},"availablePages",[59,60,61],"canonicalUrl","https://alpacahack.com/challenges/nano-services","Description","Solves","Writeups","solves",66,"difficulty",65,"flagFormat","Alpaca{...}","categories",[139],"attachments",[135],"remote",{"_132":133,"_134":99},"description","Very small services.\n\n

Beginner Hint 1: About the Admin Bot

\n\n- In this challenge, you are given not only the web application itself but also an Admin Bot.\n- The Admin Bot has a cookie containing the flag, and it opens a specified path using headless Chrome.\n- Therefore, your goal is to make the Admin Bot trigger your payload and send the cookie value to an external server.\n- You can prepare your own server as the destination or use an existing service that lets you receive and inspect HTTP requests.\n- If you are not yet familiar with how to use the Admin Bot or how to inspect incoming requests, it may help to solve [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) first and read its writeup.\n\n

Beginner Hint 2: Approach

\n\n- The cookie has the `HttpOnly` flag enabled. This means that even if you succeed in XSS, you cannot leak the cookie using `document.cookie`.\n- It looks like there are 3 functions you can choose from via the `func` parameter. Is that all?\n\n

\n","descriptionJa","ちっちゃいちっちゃいサービス。\n\n

Beginner Hint 1: Admin Botについて

\n\n- この問題では、Webアプリ本体とは別に Admin Bot が用意されています。\n- Admin Bot はフラグ入りのCookieを持った状態で、指定されたパスを Headless Chrome で開きます。\n- そのため、目標は「Admin Bot に自分の用意したペイロードを踏ませて、Cookieの内容を外部へ送らせること」です。\n- 送信先は自分でサーバーを立ててもよいですし、HTTPリクエストを受け取って確認できる既存サービスを使っても構いません。\n- Admin Bot の使い方や、外部から受信したリクエストの確認方法がまだ曖昧なら、先に [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) を解いてWriteupを読むことをおすすめします。\n\n

Beginner Hint 2: アプローチ

\n\n- Cookie には `HttpOnly` フラグが設定されています。そのため、たとえ XSS に成功したとしても、`document.cookie` を使って Cookie をリークさせることはできません。\n- `func` パラメータで指定できる関数は3つあるようですが、本当にこれだけでしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[129],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[124,125],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_111":112,"_93":94,"_113":114,"_115":116,"_117":118,"_119":120},"nextDailyCanonical","super-short-system-exit","httpsProxyHostname","nano-services.chal.alp4ca.com","program",{"_22":104,"_20":121,"_122":123},"scheduledDate",["D",1782658800000],"releaseAt",["D",1782658800000],"status","PUBLISHED","plannedTopic","XSS","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":127,"_22":128},{"_20":120,"_22":126},"xss","PHP","php",{"_20":130,"_45":131},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_136":137,"_37":138},"fileName","nano-services.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/ca4c8bc0-6676-4aee-85e0-a0fb58af44cf/nano-services.tar.gz",{"_20":140,"_22":141},"Web","web","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_152":153,"_154":99,"_155":156,"_157":156,"_158":159,"_160":161,"_162":16,"_163":144},"cspNonce","firebaseOptions",{"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":159},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]