[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_204":205,"_206":166},"routes/_root/_root",{"_201":-7,"_41":202,"_138":-7,"_203":-7},"routes/_root.tags.$tagCanonical+/_root",{"_37":161,"_73":162,"_163":16,"_164":165},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/_root",{"_69":70,"_71":72,"_73":74},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27],"name","One More Login Challenge","canonicalName","one-more-login-challenge",{"_28":61,"_30":62,"_32":63,"_34":16,"_35":16,"_36":16,"_37":64,"_39":65,"_41":42,"_43":16,"_44":66},{"_28":55,"_30":56,"_32":57,"_34":16,"_35":16,"_36":16,"_37":38,"_39":58,"_41":42,"_43":16,"_44":59},{"_28":48,"_30":49,"_32":50,"_34":16,"_35":16,"_36":16,"_37":38,"_39":51,"_41":42,"_43":16,"_44":52},{"_28":29,"_30":31,"_32":33,"_34":16,"_35":16,"_36":16,"_37":38,"_39":40,"_41":42,"_43":16,"_44":45},"author",{"_20":46,"_47":-5},"writeupElementId","46c1ac3a","writeupId","46c1ac3a-b917-4ebb-8425-cf29fcbd2753","canEdit","canLike","likedByViewer","title","Writeup for One More Login Challenge","url","https://github.com/nozokare/my-alpaca-ctf/blob/main/2026-04/16-daily-one-more-login-challenge/README.md","language","ja","isOfficial","createdAt",["D",1776702151894],"nozokare","gravatarHash",{"_20":53,"_47":54},"13206afb","13206afb-7ade-4fed-a3fe-c05c63434aad","https://github.com/tadanobutubutu/one-more-login-challenge-solve/blob/main/README.md",["D",1776380468538],"tadanobutubutu","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":60,"_47":-5},"a5adea50","a5adea50-b78e-48de-863b-578f0615a059","https://github.com/goroshirow/CTF-WriteUps/tree/main/AlpacaHack/2026Apr/One%20More%20Login%20Challenge",["D",1776354927548],"goroshirow",{"_20":67,"_47":68},"da7869b6","da7869b6-dcd6-4f41-b1e9-832de60e361b","Writeup for Daily AlpacaHack 4/12-4/18","https://www.notion.so/kakur41-wrteup/Daily-AlpacaHack-4-12-4-18-340da8520c02801e8052c0cc0dc9ea1a?source=copy_link",["D",1777106349280],"kakur41","b38a5e77015b23df77d112279a16aaba1c929e984106792bf5505dff367d67fa","challenge",{"_20":21,"_22":23,"_78":79,"_80":81,"_82":83,"_84":85,"_86":87,"_88":89,"_90":91,"_92":93,"_94":16,"_95":-7,"_96":97,"_98":-7,"_99":-7,"_36":16,"_100":101,"_102":103,"_104":16,"_105":-7,"_106":16,"_107":-7,"_108":-7,"_109":110,"_111":-7,"_112":-7,"_113":-7,"_114":115,"_116":16,"_117":115,"_35":115,"_118":-7,"_119":120,"_121":122,"_123":124,"_125":126},"availablePages",[75,76,77],"canonicalUrl","https://alpacahack.com/tags/nosql-injection/challenges/one-more-login-challenge","Description","Solves","Writeups","solves",139,"difficulty",35,"flagFormat","Alpaca{...}","categories",[158],"attachments",[154],"remote",{"_151":152,"_153":115},"description","Login again?!\n(Note: You don't necessarily have to solve [Another Login Challenge](https://alpacahack.com/daily/challenges/another-login-challenge) first)\n

Beginner Hint 1: Overview of the Challenge

\n\n\n- In `index.js`, a simple login feature is implemented.\n- It appears to use MongoDB to check whether a user with the submitted `username` and `password` exists.\n- It does not seem possible to create your own user. Also, a user called `admin` is registered, but guessing that password would be impossible.\n\n\n

\n\n

Beginner Hint 2: How to Approach the Challenge

\n\n- As mentioned in the comments, it seems possible to send data in both `application/x-www-form-urlencoded` and `application/json` formats. Therefore, if you use JSON, you can send non-string values in `username` and `password`.\n- The login form alone might not allow you to send the intended data. For methods of sending data without using a browser, refer to [my writeup for I wanna be the Admin](https://github.com/tepel-chen/My-CTF-Challs/blob/main/Daily%20AlpacaHack/I%20wanna%20be%20the%20Admin/README-ja.md).\n\n

\n\n

Beginner Hint 3: When you are really stuck

\n\n- Try searching for MongoDB injection or NoSQL injection.\n\n

\n","descriptionJa","またログイン?!\n(注: [Another Login Challenge](https://alpacahack.com/daily/challenges/another-login-challenge) を先に解く必要はありません)\n

初心者向けヒント1: 問題の概要

\n\n- `index.js` では、簡易的なログイン機能が実装されています。\n- MongoDBを利用して、送られた`username`と`password`のユーザーが存在するかチェックしているようです。\n- 自分でユーザーを作ることはできなさそうです。また、`admin`というユーザーが登録されていますが、そのパスワードを推測することも不可能でしょう。\n\n

\n\n

初心者向けヒント2: 問題のアプローチ

\n\n- コメントにもある通り、`application/x-www-form-urlencoded`と`application/json`の両方の形式でデータを送ることができるようです。したがって、JSONを利用すれば`username`と`password`に文字列以外のデータを送れます。\n- ログイン画面の機能だけでは意図したデータを送れないかもしれません。ブラウザ以外の方法でデータを送る方法については、[I wanna be the AdminのWriteup](https://github.com/tepel-chen/My-CTF-Challs/blob/main/Daily%20AlpacaHack/I%20wanna%20be%20the%20Admin/README-ja.md) を参考にしてください。\n\n

初心者向けヒント3: 本当に詰まった時は

\n\n- MongoDB インジェクション、あるいはNoSQL インジェクションで検索してみましょう。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[148],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[140,141,142],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_127":128,"_109":110,"_129":130,"_131":132,"_133":134,"_135":136},"nextDailyCanonical","litealpaca","httpsProxyHostname","one-more-login-challenge.chal.alp4ca.com","program",{"_22":120,"_20":137,"_138":139},"scheduledDate",["D",1776265200000],"releaseAt",["D",1776265200000],"status","PUBLISHED","plannedTopic","MongoDB","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":136,"_22":147},{"_20":145,"_22":146},{"_20":143,"_22":144},"Authentication Bypass","authentication-bypass","NoSQL Injection","nosql-injection","mongodb",{"_20":149,"_47":150},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_155":156,"_39":157},"fileName","one-more-login-challenge.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/f6ceef92-52ed-42de-86ff-19ab8fa3a711/one-more-login-challenge.tar.gz",{"_20":159,"_22":160},"Web","web","Tag: NoSQL Injection","https://alpacahack.com/tags/nosql-injection","isLoggedIn","tag",{"_20":145,"_22":146,"_90":166,"_92":167,"_96":168,"_169":170,"_171":172,"_173":174},"","NoSQL Injection は、NoSQL データベースへの問い合わせに攻撃者の入力が意図しない形で組み込まれる脆弱性です。\n\nCTF では、JSON 形式の演算子、型の違い、検索条件の改竄を利用して認証回避や情報取得を狙う問題で扱われます。\n",[199],"updatedAt",["D",1781727589247],"challenges",[175,176],"relatedTags",[],{"_20":21,"_22":23,"_78":79,"_102":191,"_96":192,"_84":193,"_98":-7},{"_20":177,"_22":178,"_78":179,"_102":180,"_96":181,"_84":182,"_98":-7},"Alpaca Poll","alpaca-poll",129,[187,188],[184],[183],{"_20":159,"_22":160},{"_20":185,"_47":186},"st98","37f51aac7add5090cf6ba6a765986eb1540d2ae05543dde9190df41f3b9e1934",{"_20":145,"_22":146},{"_20":189,"_22":190},"Redis","redis",[196,197,198],[195],[194],{"_20":159,"_22":160},{"_20":149,"_47":150},{"_20":136,"_22":147},{"_20":145,"_22":146},{"_20":143,"_22":144},{"_20":200,"_47":-5},"alpakun","user","en","timeZoneAbbr","clientConfig",{"_207":208,"_209":115,"_210":211,"_212":211,"_213":214,"_215":216,"_217":16,"_218":166},"cspNonce","firebaseOptions",{"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":214},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]