:pizza: -> 🍕
Beginner Hint 1: About Difficulty
- This challenge is in the Web category, i.e., web applications.
- Unlike yesterday's challenge, which was Easy, this one is Medium.
- Daily AlpacaHack currently defines four difficulty levels: Easy, Medium, Hard, and Very Hard.
- Medium is one step above Easy. If Daily AlpacaHack is your first exposure to CTF, solving it may be tough.
- If you get stuck, feel free to lean on AI to find a starting point for the solution.
- Even if you can't solve it, check other players' solutions (writeups) afterward to review and learn.
- 24 hours after release, a writeup tab will appear in the tab bar below.
Beginner Hint 2: Running the Challenge Locally
- After extracting the attachment, you'll find
compose.yaml,Dockerfile, and directories for three services. - Modern CTFs often ship a Docker Compose file so players can reproduce the remote environment locally.
- From the root of the distribution, run
docker compose up. - With default settings, the challenge server will start at
http://localhost:3000/. - Use this local server to investigate vulnerabilities and to test the solver you build.
Beginner Hint 3: Approach to Solving the Challenge (AI-translated)
- Start by reading the source code to understand what kind of web service is running.
- It will be easier to understand if you read the code while checking how the challenge server behaves locally.
- Once you roughly understand the service's behavior, the next step is to identify the goal.
- Think about where the flag is and what you need to be able to do to obtain it. Then you will see that achieving that "what you need to be able to do" is the point of this challenge.
- The challenge server is written in JavaScript.
- To check the detailed behavior of JavaScript functions, it is useful to have an interactive environment where you can run JavaScript.
- Try running the
nodecommand in your local terminal and experimenting with it. - It is also useful to look up the specifications of the JavaScript functions used in the challenge.
- MDN documentation (https://developer.mozilla.org/en-US/docs/Web) is accurate and comprehensive, so it is a useful information resource.