[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_148":149,"_150":144},"routes/_root/_root",{"_146":-7,"_39":50,"_122":-7,"_147":-7},"routes/_root.challenges",{"_35":142,"_143":144,"_145":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_53":54,"_55":56,"_57":58},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25],"name","TODO List","canonicalName","todo-list",{"_26":46,"_28":47,"_30":48,"_32":16,"_33":16,"_34":16,"_35":36,"_37":49,"_39":50,"_41":16,"_42":51},{"_26":27,"_28":29,"_30":31,"_32":16,"_33":16,"_34":16,"_35":36,"_37":38,"_39":40,"_41":16,"_42":43},"author",{"_20":44,"_45":-5},"writeupElementId","852da1fa","writeupId","852da1fa-ae86-4961-9fe2-9641a2522844","canEdit","canLike","likedByViewer","title","Writeup for TODO List","url","https://github.com/nozokare/my-alpaca-ctf/tree/main/2026-05/27-bside-todo-list","language","ja","isOfficial","createdAt",["D",1780674444614],"nozokare","gravatarHash",{"_20":52,"_45":-5},"f29441d3","f29441d3-e668-4bef-9c60-7653e329281f","https://github.com/bdsvac/ctf-public/blob/main/alpaca/web/todo-list/solve.py","en",["D",1780094551640],"bsvac","challenge",{"_20":21,"_22":23,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":73,"_74":75,"_76":77,"_78":16,"_79":-7,"_80":81,"_82":-7,"_83":-7,"_34":16,"_84":85,"_86":87,"_88":16,"_89":-7,"_90":16,"_91":-7,"_92":-7,"_93":94,"_95":-7,"_96":-7,"_97":-7,"_98":99,"_100":16,"_101":99,"_33":99,"_102":-7,"_103":104,"_105":106,"_107":108,"_109":110},"availablePages",[59,60,61],"canonicalUrl","https://alpacahack.com/challenges/todo-list","Description","Solves","Writeups","solves",28,"difficulty",70,"flagFormat","Alpaca{...}","categories",[139],"attachments",[135],"remote",{"_132":133,"_134":99},"description","TODO: Check if this website doesn't contain any XSS.\n

Beginner Hint1: About the Admin Bot

\n\n- In this challenge, you are given not only the web application itself, but also an Admin Bot.\n- The Admin Bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.\n- Therefore, your goal is to make the Admin Bot trigger your payload and send the cookie value to an external server.\n- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.\n- If you are still not familiar with how to use the Admin Bot or how to inspect incoming requests, it may help to solve [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) first and read its writeup.\n\n

Beginner Hint2: Overview of the Challenge

\n\n- This is a simple TODO application. When you first visit it, you get a session ID, and you can create a TODO list associated with that session.\n- If you specify `?sessionId=...`, you can also view the list associated with another user's session. In other words, you can make the Admin Bot open your own session.\n- Each TODO item accepts HTML input, but it is not rendered as-is. The app sanitizes it with [DOMPurify](https://github.com/cure53/DOMPurify).\n- DOMPurify itself is the latest version, so this probably is not a challenge where you exploit an old known vulnerability in DOMPurify directly.\n\n

Beginner Hint3: Approach

\n\n- A basic rule when using a sanitizer like DOMPurify is that you should not further transform the sanitized string afterward.\n- In this application, is the data left untouched after sanitization?\n\n

\n","descriptionJa","TODO: このサイトにXSSが無いか確認する\n

Beginner Hint1: Admin Botについて

\n\n- この問題では、Webアプリ本体とは別に Admin Bot が用意されています。\n- Admin Bot はフラグ入りのCookieを持った状態で、指定されたパスを Headless Chrome で開きます。\n- そのため、目標は「Admin Bot に自分の用意したペイロードを踏ませて、Cookieの内容を外部へ送らせること」です。\n- 送信先は自分でサーバーを立ててもよいですし、HTTPリクエストを受け取って確認できる既存サービスを使っても構いません。\n- Admin Bot の使い方や、外部から受信したリクエストの確認方法がまだ曖昧なら、先に [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) を解いてWriteupを読むことをおすすめします。\n\n

Beginner Hint2: この問題の概要

\n\n- このアプリはシンプルなTODOアプリです。最初にアクセスするとセッションIDが発行され、そのセッションに紐づくTODOリストを作成できます。\n- `?sessionId=...` を指定すると、他人のセッションに対応するリストも閲覧できます。つまり、Admin Bot に自分のセッションIDを開かせることができます。\n- TODOの各アイテムにはHTMLを入力できますが、そのまま表示しているわけではなく、[DOMPurify](https://github.com/cure53/DOMPurify) でサニタイズしてあります。\n- DOMPurify 自体は最新版なので、「古い既知脆弱性をそのまま突く」方向ではなさそうです。\n\n

Beginner Hint3: この問題のアプローチ

\n\n- DOMPurify のようなサニタイザを使うときの基本原則は、「サニタイズしたあとの文字列を、あとから別の形に加工しないこと」です。\n- このアプリでは、サニタイズ後のデータは加工されているでしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[129],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[124,125],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","hard","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack-bside","dailyChallengeSlot",{"_111":112,"_93":94,"_113":114,"_115":116,"_117":118,"_119":120},"nextDailyCanonical","re-small-d","httpsProxyHostname","todo-list.chal.alp4ca.com","program",{"_22":104,"_20":121,"_122":123},"scheduledDate",["D",1779807600000],"releaseAt",["D",1779807600000],"status","PUBLISHED","plannedTopic","XSS","Daily AlpacaHack B-SIDE","timeZone","Asia/Tokyo",{"_20":120,"_22":128},{"_20":126,"_22":127},"DOMPurify","dompurify","xss",{"_20":130,"_45":131},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_136":137,"_37":138},"fileName","todo-list.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/501bdbfd-6adc-403a-bee6-e9f13d8e28da/todo-list.tar.gz",{"_20":140,"_22":141},"Web","web","Challenges","query","","isLoggedIn","user","timeZoneAbbr","clientConfig",{"_151":152,"_153":99,"_154":155,"_156":155,"_157":158,"_159":160,"_161":16,"_162":144},"cspNonce","firebaseOptions",{"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":158},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]