[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_166":167,"_168":161},"routes/_root/_root",{"_163":-7,"_41":164,"_136":-7,"_165":-7},"routes/_root.challenges",{"_37":159,"_160":161,"_162":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_69":70,"_71":72,"_73":74},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27],"name","One More Login Challenge","canonicalName","one-more-login-challenge",{"_28":61,"_30":62,"_32":63,"_34":16,"_35":16,"_36":16,"_37":64,"_39":65,"_41":42,"_43":16,"_44":66},{"_28":55,"_30":56,"_32":57,"_34":16,"_35":16,"_36":16,"_37":38,"_39":58,"_41":42,"_43":16,"_44":59},{"_28":48,"_30":49,"_32":50,"_34":16,"_35":16,"_36":16,"_37":38,"_39":51,"_41":42,"_43":16,"_44":52},{"_28":29,"_30":31,"_32":33,"_34":16,"_35":16,"_36":16,"_37":38,"_39":40,"_41":42,"_43":16,"_44":45},"author",{"_20":46,"_47":-5},"writeupElementId","46c1ac3a","writeupId","46c1ac3a-b917-4ebb-8425-cf29fcbd2753","canEdit","canLike","likedByViewer","title","Writeup for One More Login Challenge","url","https://github.com/nozokare/my-alpaca-ctf/blob/main/2026-04/16-daily-one-more-login-challenge/README.md","language","ja","isOfficial","createdAt",["D",1776702151894],"nozokare","gravatarHash",{"_20":53,"_47":54},"13206afb","13206afb-7ade-4fed-a3fe-c05c63434aad","https://github.com/tadanobutubutu/one-more-login-challenge-solve/blob/main/README.md",["D",1776380468538],"tadanobutubutu","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":60,"_47":-5},"a5adea50","a5adea50-b78e-48de-863b-578f0615a059","https://github.com/goroshirow/CTF-WriteUps/tree/main/AlpacaHack/2026Apr/One%20More%20Login%20Challenge",["D",1776354927548],"goroshirow",{"_20":67,"_47":68},"da7869b6","da7869b6-dcd6-4f41-b1e9-832de60e361b","Writeup for Daily AlpacaHack 4/12-4/18","https://www.notion.so/kakur41-wrteup/Daily-AlpacaHack-4-12-4-18-340da8520c02801e8052c0cc0dc9ea1a?source=copy_link",["D",1777106349280],"kakur41","b38a5e77015b23df77d112279a16aaba1c929e984106792bf5505dff367d67fa","challenge",{"_20":21,"_22":23,"_78":79,"_80":81,"_82":83,"_84":85,"_86":87,"_88":89,"_90":91,"_92":16,"_93":-7,"_94":95,"_96":-7,"_97":-7,"_36":16,"_98":99,"_100":101,"_102":16,"_103":-7,"_104":16,"_105":-7,"_106":-7,"_107":108,"_109":-7,"_110":-7,"_111":-7,"_112":113,"_114":16,"_115":113,"_35":113,"_116":-7,"_117":118,"_119":120,"_121":122,"_123":124},"availablePages",[75,76,77],"canonicalUrl","https://alpacahack.com/challenges/one-more-login-challenge","Description","Solves","Writeups","solves",135,"flagFormat","Alpaca{...}","categories",[156],"attachments",[152],"remote",{"_149":150,"_151":113},"description","Login again?!\n(Note: You don't necessarily have to solve [Another Login Challenge](https://alpacahack.com/daily/challenges/another-login-challenge) first)\n

Beginner Hint 1: Overview of the Challenge

\n\n\n- In `index.js`, a simple login feature is implemented.\n- It appears to use MongoDB to check whether a user with the submitted `username` and `password` exists.\n- It does not seem possible to create your own user. Also, a user called `admin` is registered, but guessing that password would be impossible.\n\n\n

\n\n

Beginner Hint 2: How to Approach the Challenge

\n\n- As mentioned in the comments, it seems possible to send data in both `application/x-www-form-urlencoded` and `application/json` formats. Therefore, if you use JSON, you can send non-string values in `username` and `password`.\n- The login form alone might not allow you to send the intended data. For methods of sending data without using a browser, refer to [my writeup for I wanna be the Admin](https://github.com/tepel-chen/My-CTF-Challs/blob/main/Daily%20AlpacaHack/I%20wanna%20be%20the%20Admin/README-ja.md).\n\n

\n\n

Beginner Hint 3: When you are really stuck

\n\n- Try searching for MongoDB injection or NoSQL injection.\n\n

\n","descriptionJa","またログイン?!\n(注: [Another Login Challenge](https://alpacahack.com/daily/challenges/another-login-challenge) を先に解く必要はありません)\n

初心者向けヒント1: 問題の概要

\n\n- `index.js` では、簡易的なログイン機能が実装されています。\n- MongoDBを利用して、送られた`username`と`password`のユーザーが存在するかチェックしているようです。\n- 自分でユーザーを作ることはできなさそうです。また、`admin`というユーザーが登録されていますが、そのパスワードを推測することも不可能でしょう。\n\n

\n\n

初心者向けヒント2: 問題のアプローチ

\n\n- コメントにもある通り、`application/x-www-form-urlencoded`と`application/json`の両方の形式でデータを送ることができるようです。したがって、JSONを利用すれば`username`と`password`に文字列以外のデータを送れます。\n- ログイン画面の機能だけでは意図したデータを送れないかもしれません。ブラウザ以外の方法でデータを送る方法については、[I wanna be the AdminのWriteup](https://github.com/tepel-chen/My-CTF-Challs/blob/main/Daily%20AlpacaHack/I%20wanna%20be%20the%20Admin/README-ja.md) を参考にしてください。\n\n

初心者向けヒント3: 本当に詰まった時は

\n\n- MongoDB インジェクション、あるいはNoSQL インジェクションで検索してみましょう。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[146],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[138,139,140],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_125":126,"_107":108,"_127":128,"_129":130,"_131":132,"_133":134},"nextDailyCanonical","litealpaca","httpsProxyHostname","one-more-login-challenge.chal.alp4ca.com","program",{"_22":118,"_20":135,"_136":137},"scheduledDate",["D",1776265200000],"releaseAt",["D",1776265200000],"status","PUBLISHED","plannedTopic","MongoDB","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":144,"_22":145},{"_20":134,"_22":143},{"_20":141,"_22":142},"NoSQL Injection","nosql-injection","mongodb","Authentication Bypass","authentication-bypass",{"_20":147,"_47":148},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_153":154,"_39":155},"fileName","one-more-login-challenge.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/f6ceef92-52ed-42de-86ff-19ab8fa3a711/one-more-login-challenge.tar.gz",{"_20":157,"_22":158},"Web","web","Challenges","query","","isLoggedIn","user","en","timeZoneAbbr","clientConfig",{"_169":170,"_171":113,"_172":173,"_174":173,"_175":176,"_177":178,"_179":16,"_180":161},"cspNonce","firebaseOptions",{"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":176},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]