[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_123":124,"_125":117},"routes/_root/_root",{"_119":-7,"_120":121,"_95":-7,"_122":-7},"routes/_root.challenges",{"_114":115,"_116":117,"_118":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_24":25,"_26":27,"_28":29},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[],"name","Small Image Uploader 2","canonicalName","small-image-uploader-2","challenge",{"_20":21,"_22":23,"_33":34,"_35":-7,"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":16,"_49":-7,"_50":51,"_52":-7,"_53":-7,"_54":16,"_55":56,"_57":58,"_59":16,"_60":-7,"_61":16,"_62":-7,"_63":-7,"_64":65,"_66":-7,"_67":-7,"_68":-7,"_69":70,"_71":16,"_72":70,"_73":70,"_74":16,"_75":-7,"_76":77,"_78":79,"_80":81,"_82":83},"availablePages",[30,31,32],"canonicalUrl","https://alpacahack.com/challenges/small-image-uploader-2","Description","Solves","Writeups","solves",45,"difficulty","flagFormat","Alpaca{...}","categories",[111],"attachments",[106],"remote",{"_103":104,"_105":70},"description","small_img.png\n\nNOTE: You don't need to solve Small Image Uploader first.\n\n

Beginner Hint 1: About the Admin Bot

\n\n- In this challenge, you are given not only the web application itself, but also an admin bot.\n- The admin bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.\n- Therefore, your goal is to make the admin bot trigger your payload and send the cookie value to an external server.\n- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.\n- If you are still not familiar with how to use the admin bot or how to inspect incoming requests, it may help to first solve [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) and read its writeup.\n\n

Beginner Hint 2: Approach

\n\n- When the admin bot opens `GET /api/file/` directly, what response header tells the browser how to treat the returned content? The displayed URL or file extension is not what matters at that point.\n- Not all image formats are binary; some are text-based, and one XML-based image format can contain JavaScript when opened directly in the browser. Which image format is that?\n\n

\n","descriptionJa","small_img.png\n\n注意: Small Image Uploader を先に解く必要はありません。\n\n

Beginner Hint 1: Admin Botについて

\n\n- この問題では、Webアプリ本体とは別に Admin Bot が用意されています。\n- Admin Bot はフラグ入りのCookieを持った状態で、指定されたパスを Headless Chrome で開きます。\n- そのため、目標は「Admin Bot に自分の用意したペイロードを踏ませて、Cookieの内容を外部へ送らせること」です。\n- 送信先は自分でサーバーを立ててもよいですし、HTTPリクエストを受け取って確認できる既存サービスを使っても構いません。\n- Admin Bot の使い方や、外部から受信したリクエストの確認方法がまだ曖昧なら、先に [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) を解いてWriteupを読むことをおすすめします。\n\n

Beginner Hint 2: この問題のアプローチ

\n\n- Admin Bot が `GET /api/file/` を直接開いたとき、ブラウザはレスポンスの何を見て返ってきた内容の扱いを決めているのでしょうか？その時点では、表示されているURLやファイル拡張子が本質ではありません。\n- すべての画像形式がバイナリでできているわけではありません。テキストベースのものもあり、ブラウザで直接開くと JavaScript を含められることがある XML ベースの画像形式もあります。それはどの画像形式でしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[99],"solvedAt","solvedAtInContext","likedByViewer","ctfChallenges",[],"tags",[97],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","canLike","showcaseMode","dailyProgramCanonicalForAction","reviewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_84":85,"_64":65,"_86":87,"_88":89,"_90":91,"_92":93},"nextDailyCanonical","alpaca-day","httpsProxyHostname","small-image-uploader-2.chal.alp4ca.com","program",{"_22":77,"_20":94,"_95":96},"scheduledDate",["D",1785423600000],"releaseAt",["D",1785423600000],"status","PUBLISHED","plannedTopic","XSS","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":93,"_22":98},"xss",{"_20":100,"_101":102},"tchen","gravatarHash","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_107":108,"_109":110},"fileName","small-image-uploader-2.tar.gz","url","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/5d22ff4c-0a0a-47e2-bd8d-3814dbce94d6/small-image-uploader-2.tar.gz",{"_20":112,"_22":113},"Web","web","title","Challenges","query","","isLoggedIn","user","language","en","timeZoneAbbr","clientConfig",{"_126":127,"_128":70,"_129":130,"_131":130,"_132":133,"_134":135,"_136":16,"_137":117},"cspNonce","firebaseOptions",{"_138":139,"_140":141,"_142":143,"_144":145,"_146":147,"_148":133},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]