[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_185":186,"_187":88,"_188":189,"_190":189,"_191":192,"_193":194,"_195":16,"_196":151,"_197":151},"routes/_root/_root",{"_182":-7,"_37":183,"_123":-7,"_184":-7},"routes/_root.tags.$tagCanonical+/_root",{"_33":146,"_66":147,"_148":16,"_149":150},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/_root",{"_62":63,"_64":65,"_66":67},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27],"name","One More Login Challenge","canonicalName","one-more-login-challenge",{"_28":57,"_30":58,"_32":-7,"_33":47,"_35":59,"_37":38,"_39":16,"_40":60},{"_28":51,"_30":52,"_32":-7,"_33":47,"_35":53,"_37":38,"_39":16,"_40":54},{"_28":45,"_30":46,"_32":-7,"_33":47,"_35":48,"_37":38,"_39":16,"_40":49},{"_28":29,"_30":31,"_32":-7,"_33":34,"_35":36,"_37":38,"_39":16,"_40":41},"author",{"_20":42,"_43":44},"writeupElementId","da7869b6","writeupId","title","Writeup for Daily AlpacaHack 4/12-4/18","url","https://www.notion.so/kakur41-wrteup/Daily-AlpacaHack-4-12-4-18-340da8520c02801e8052c0cc0dc9ea1a?source=copy_link","language","ja","isOfficial","createdAt",["D",1777106349280],"kakur41","gravatarHash","b38a5e77015b23df77d112279a16aaba1c929e984106792bf5505dff367d67fa",{"_20":50,"_43":-5},"46c1ac3a","Writeup for One More Login Challenge","https://github.com/nozokare/my-alpaca-ctf/blob/main/2026-04/16-daily-one-more-login-challenge/README.md",["D",1776702151894],"nozokare",{"_20":55,"_43":56},"13206afb","https://github.com/tadanobutubutu/one-more-login-challenge-solve/blob/main/README.md",["D",1776380468538],"tadanobutubutu","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":61,"_43":-5},"a5adea50","https://github.com/goroshirow/CTF-WriteUps/tree/main/AlpacaHack/2026Apr/One%20More%20Login%20Challenge",["D",1776354927548],"goroshirow","challenge",{"_20":21,"_22":23,"_71":72,"_73":74,"_75":76,"_77":78,"_79":80,"_81":82,"_83":84,"_85":16,"_86":-7,"_87":88,"_89":90,"_91":-7,"_92":-7,"_93":16,"_94":95,"_96":97,"_98":16,"_99":-7,"_100":16,"_101":-7,"_102":-7,"_103":104,"_105":-7,"_106":-7,"_107":-7,"_108":88,"_109":110,"_111":112,"_113":114},"availablePages",[68,69,70],"canonicalUrl","https://alpacahack.com/challenges/one-more-login-challenge","Description","Solves","Writeups","solves",129,"flagFormat","Alpaca{...}","categories",[143],"attachments",[139],"remote",{"_136":137,"_138":88},"description","Login again?!\n(Note: You don't necessarily have to solve [Another Login Challenge](https://alpacahack.com/daily/challenges/another-login-challenge) first)\n

Beginner Hint 1: Overview of the Challenge

\n\n\n- In `index.js`, a simple login feature is implemented.\n- It appears to use MongoDB to check whether a user with the submitted `username` and `password` exists.\n- It does not seem possible to create your own user. Also, a user called `admin` is registered, but guessing that password would be impossible.\n\n\n

\n\n

Beginner Hint 2: How to Approach the Challenge

\n\n- As mentioned in the comments, it seems possible to send data in both `application/x-www-form-urlencoded` and `application/json` formats. Therefore, if you use JSON, you can send non-string values in `username` and `password`.\n- The login form alone might not allow you to send the intended data. For methods of sending data without using a browser, refer to [my writeup for I wanna be the Admin](https://github.com/tepel-chen/My-CTF-Challs/blob/main/Daily%20AlpacaHack/I%20wanna%20be%20the%20Admin/README-ja.md).\n\n

\n\n

Beginner Hint 3: When you are really stuck

\n\n- Try searching for MongoDB injection or NoSQL injection.\n\n

\n","descriptionJa","またログイン?!\n(注: [Another Login Challenge](https://alpacahack.com/daily/challenges/another-login-challenge) を先に解く必要はありません)\n

初心者向けヒント1: 問題の概要

\n\n- `index.js` では、簡易的なログイン機能が実装されています。\n- MongoDBを利用して、送られた`username`と`password`のユーザーが存在するかチェックしているようです。\n- 自分でユーザーを作ることはできなさそうです。また、`admin`というユーザーが登録されていますが、そのパスワードを推測することも不可能でしょう。\n\n

\n\n

初心者向けヒント2: 問題のアプローチ

\n\n- コメントにもある通り、`application/x-www-form-urlencoded`と`application/json`の両方の形式でデータを送ることができるようです。したがって、JSONを利用すれば`username`と`password`に文字列以外のデータを送れます。\n- ログイン画面の機能だけでは意図したデータを送れないかもしれません。ブラウザ以外の方法でデータを送る方法については、[I wanna be the AdminのWriteup](https://github.com/tepel-chen/My-CTF-Challs/blob/main/Daily%20AlpacaHack/I%20wanna%20be%20the%20Admin/README-ja.md) を参考にしてください。\n\n

初心者向けヒント3: 本当に詰まった時は

\n\n- MongoDB インジェクション、あるいはNoSQL インジェクションで検索してみましょう。\n\n

\n","descriptionRequiresSignIn","changeLog","isArchived",true,"authors",[133],"solvedAt","solvedAtInContext","likedByViewer","ctfChallenges",[],"tags",[125,126,127],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge","dailyChallengeSlot",{"_115":116,"_103":104,"_117":118,"_119":120},"nextDailyCanonical","litealpaca","httpsProxyHostname","one-more-login-challenge.chal.alp4ca.com","program",{"_22":121,"_20":122,"_123":124},"scheduledDate",["D",1776265200000],"plannedTopic","MongoDB","daily-alpacahack","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":131,"_22":132},{"_20":120,"_22":130},{"_20":128,"_22":129},"NoSQL Injection","nosql-injection","mongodb","Authentication Bypass","authentication-bypass",{"_20":134,"_43":135},"tchen","df01bfb2031cc27361ba3bf749a2c9ccc4ba83bc6fe7b059875628a9fd9d9573","instances",[],"canSpawn",{"_140":141,"_35":142},"fileName","one-more-login-challenge.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/f6ceef92-52ed-42de-86ff-19ab8fa3a711/one-more-login-challenge.tar.gz",{"_20":144,"_22":145},"Web","web","Tag: NoSQL Injection","https://alpacahack.com/tags/nosql-injection","isLoggedIn","tag",{"_20":128,"_22":129,"_81":151,"_83":151,"_89":152,"_153":154,"_155":156,"_157":158},"",[],"updatedAt",["D",1776995856983],"challenges",[159,160],"relatedTags",[],{"_20":169,"_22":170,"_71":72,"_96":171,"_89":172,"_75":173,"_91":-7},{"_20":21,"_22":23,"_71":72,"_96":161,"_89":162,"_75":163,"_91":-7},[166,167,168],[165],[164],{"_20":144,"_22":145},{"_20":134,"_43":135},{"_20":131,"_22":132},{"_20":120,"_22":130},{"_20":128,"_22":129},"Alpaca Poll","alpaca-poll",[178,179],[175],[174],{"_20":144,"_22":145},{"_20":176,"_43":177},"st98","37f51aac7add5090cf6ba6a765986eb1540d2ae05543dde9190df41f3b9e1934",{"_20":128,"_22":129},{"_20":180,"_22":181},"Redis","redis","user","en","timeZoneAbbr","firebaseOptions",{"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":192},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","cspNonce","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]

NoSQL Injection

NoSQL Injection Challenges

Alpaca Poll

One More Login Challenge

One More Login Challenge