[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_124":125,"_126":118},"routes/_root/_root",{"_120":-7,"_121":122,"_93":-7,"_123":-7},"routes/_root.challenges",{"_115":116,"_117":118,"_119":16},"routes/_root.challenges.$challengeCanonical+/_root",{"_24":25,"_26":27,"_28":29},"routes/_root.challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[],"name","TODO List","canonicalName","todo-list","challenge",{"_20":21,"_22":23,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":16,"_48":-7,"_49":50,"_51":-7,"_52":-7,"_53":16,"_54":55,"_56":57,"_58":16,"_59":-7,"_60":16,"_61":-7,"_62":-7,"_63":64,"_65":-7,"_66":-7,"_67":-7,"_68":69,"_70":16,"_71":69,"_72":69,"_73":-7,"_74":75,"_76":77,"_78":79,"_80":81},"availablePages",[30,31,32],"canonicalUrl","https://alpacahack.com/challenges/todo-list","Description","Solves","Writeups","solves",21,"flagFormat","Alpaca{...}","categories",[112],"attachments",[107],"remote",{"_104":105,"_106":69},"description","TODO: Check if this website doesn't contain any XSS.\n

Beginner Hint1: About the Admin Bot

\n\n- In this challenge, you are given not only the web application itself, but also an Admin Bot.\n- The Admin Bot has a cookie containing the flag, and it opens a specified path using Headless Chrome.\n- Therefore, your goal is to make the Admin Bot trigger your payload and send the cookie value to an external server.\n- You can prepare your own server as the destination, or use an existing service that lets you receive and inspect HTTP requests.\n- If you are still not familiar with how to use the Admin Bot or how to inspect incoming requests, it may help to solve [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) first and read its writeup.\n\n

Beginner Hint2: Overview of the Challenge

\n\n- This is a simple TODO application. When you first visit it, you get a session ID, and you can create a TODO list associated with that session.\n- If you specify `?sessionId=...`, you can also view the list associated with another user's session. In other words, you can make the Admin Bot open your own session.\n- Each TODO item accepts HTML input, but it is not rendered as-is. The app sanitizes it with [DOMPurify](https://github.com/cure53/DOMPurify).\n- DOMPurify itself is the latest version, so this probably is not a challenge where you exploit an old known vulnerability in DOMPurify directly.\n\n

Beginner Hint3: Approach

\n\n- A basic rule when using a sanitizer like DOMPurify is that you should not further transform the sanitized string afterward.\n- In this application, is the data left untouched after sanitization?\n\n

\n","descriptionJa","TODO: このサイトにXSSが無いか確認する\n

Beginner Hint1: Admin Botについて

\n\n- この問題では、Webアプリ本体とは別に Admin Bot が用意されています。\n- Admin Bot はフラグ入りのCookieを持った状態で、指定されたパスを Headless Chrome で開きます。\n- そのため、目標は「Admin Bot に自分の用意したペイロードを踏ませて、Cookieの内容を外部へ送らせること」です。\n- 送信先は自分でサーバーを立ててもよいですし、HTTPリクエストを受け取って確認できる既存サービスを使っても構いません。\n- Admin Bot の使い方や、外部から受信したリクエストの確認方法がまだ曖昧なら、先に [Fushigi Crawler](https://alpacahack.com/daily/challenges/fushigi-crawler?month=2026-01) を解いてWriteupを読むことをおすすめします。\n\n

Beginner Hint2: この問題の概要

\n\n- このアプリはシンプルなTODOアプリです。最初にアクセスするとセッションIDが発行され、そのセッションに紐づくTODOリストを作成できます。\n- `?sessionId=...` を指定すると、他人のセッションに対応するリストも閲覧できます。つまり、Admin Bot に自分のセッションIDを開かせることができます。\n- TODOの各アイテムにはHTMLを入力できますが、そのまま表示しているわけではなく、[DOMPurify](https://github.com/cure53/DOMPurify) でサニタイズしてあります。\n- DOMPurify 自体は最新版なので、「古い既知脆弱性をそのまま突く」方向ではなさそうです。\n\n

Beginner Hint3: この問題のアプローチ

\n\n- DOMPurify のようなサニタイザを使うときの基本原則は、「サニタイズしたあとの文字列を、あとから別の形に加工しないこと」です。\n- このアプリでは、サニタイズ後のデータは加工されているでしょうか？\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[100],"solvedAt","solvedAtInContext","likedByViewer","ctfChallenges",[],"tags",[95,96],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","hard","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","canLike","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack-bside","dailyChallengeSlot",{"_82":83,"_63":64,"_84":85,"_86":87,"_88":89,"_90":91},"nextDailyCanonical","re-small-d","httpsProxyHostname","todo-list.chal.alp4ca.com","program",{"_22":75,"_20":92,"_93":94},"scheduledDate",["D",1779807600000],"releaseAt",["D",1779807600000],"status","PUBLISHED","plannedTopic","XSS","Daily AlpacaHack B-SIDE","timeZone","Asia/Tokyo",{"_20":91,"_22":99},{"_20":97,"_22":98},"DOMPurify","dompurify","xss",{"_20":101,"_102":103},"tchen","gravatarHash","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_108":109,"_110":111},"fileName","todo-list.tar.gz","url","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/501bdbfd-6adc-403a-bee6-e9f13d8e28da/todo-list.tar.gz",{"_20":113,"_22":114},"Web","web","title","Challenges","query","","isLoggedIn","user","language","en","timeZoneAbbr","clientConfig",{"_127":128,"_129":69,"_130":131,"_132":131,"_133":134,"_135":136,"_137":16,"_138":118},"cspNonce","firebaseOptions",{"_139":140,"_141":142,"_143":144,"_145":146,"_147":148,"_149":134},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]