> For the complete documentation index, see [llms.txt](https://bugology.intigriti.io/intigriti-monthly-challenges/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://bugology.intigriti.io/intigriti-monthly-challenges/1026.md).

# 1026: Halloween Store

Writeup for the Intigriti September 2026 challenge 💥

| Name                                                                                  | Authors                             | Category                   |
| ------------------------------------------------------------------------------------- | ----------------------------------- | -------------------------- |
| [Intigriti October Challenge (2026)](https://challenge-1026.challenges.intigriti.io/) | [Globules](https://x.com/INTIGRITI) | Logic flaw, race condition |

## Challenge Description

> Capture the flag and win Intigriti swag! 🏆

## Community Writeups

1. [zar](https://github.com/Franc-Zar/CTFsWriteups/tree/main/intigriti/october-challenge-1026)
2. [dd5](https://pepdep.com/posts/two-codes-four-discounts)
3. [leetcs](https://github.com/xpl01t-z3r0/Intigriti-CTF/blob/main/Halloween%20/Readme.md)
4. [0xghool](https://medium.com/@alielghool945/from-66-credits-to-a-free-order-exploiting-a-coupon-logic-flaw-4602ab5ec5c7)
5. [sangiihacks](https://sangiihacks.hashnode.dev/how-i-solved-intigriti-s-october-2026-challenge-free-checkout-via-a-client-supplied-promotions-key)
6. [boh](https://github.com/baha0x13/ctf_writeups/blob/main/intigriti_challenge_1026/WRITEUP.md)
7. [rmxyacine](https://0wnr.medium.com/the-coupon-that-meant-different-things-to-two-functions-63b5364905eb)
8. [timtimpx](https://timotheegirard.com/intigriti-1026-coupon-stacking-dedup-bypass/)
9. [cl4nd3st1ne](https://cl4nd3st1ne.gitbook.io/write-ups/intigriti-challenges/challenge-1026-write-up)
10. [shadidkayes](https://medium.com/@shadidkayes/chaining-discount-coupons-to-get-a-product-for-free-intigriti-october-challenge-1026-9f53c343c63a?sharedUserId=shadidkayes)
11. [ryuk0x01](https://ryuk0x01.github.io/posts/halloween-store-write-up/)
12. [r0m1l](https://romilp619.github.io/CTF/Intigriti-1026-Halloween-Store/)
13. [bangaalderson](https://bangaalderson-1026-halloween-store.netlify.app/)
14. [0xcaptainfahim](https://medium.com/@0xCaptainFahim/intigriti-october-ctf-writeup-exploiting-flawed-business-logic-for-a-100-discount-43a6b56ab9fa?sharedUserId=0xCaptainFahim)
15. [elinaiscooking](https://medium.com/@elinapurple/intigriti-challenge-1026-a-smelly-business-logic-bug-ce867bacdb40)
16. [savi0r](https://medium.com/@savi0r/intigriti-halloween-challenge-1026-by-globules-writeup-6a830d69ffa2)
17. [raffaele365](https://github.com/raffaele1991/intigriti-ctf-october-2026)
18. [sammii3](https://medium.com/@0xnomad/business-logic-flaw-free-checkout-via-coupon-stacking-1d5525cd5665)
19. [hacker\_np](https://medium.com/@hacker_np/that-coupon-already-applied-error-was-lying-to-me-intigriti-monthly-challenge-write-up-fa610e3f0514)
20. [bl4ck\_570rm](https://medium.com/@mahmidulhasan8/how-i-solved-intigritis-october-2026-challenge-a-business-logic-flaw-that-allowed-a-100-discount-f13383495728)
21. [sto](https://yourssto.github.io/posts/intigriti-challenge-1026-writeup/)
22. [zabedullahpoyel](https://medium.com/@zabedullahpoyel/exploiting-coupon-stacking-to-get-a-free-checkout-intigriti-october-2026-ctf-write-up-07583809bee6)
23. [zhansan](https://blog.csdn.net/zhanqinli/article/details/169145525?spm=1001.2014.3001.5501)
24. [pollo\_con\_yerbabuena](https://labs.hellnrock.com/writeups/halloween-store)
25. [keyoes](https://keyoes.com/writeups/intigriti-challenge-1026-halloween-store/)
26. [err0n](https://github.com/Er01vkc/write-ups/blob/main/Web/Intigriti-Monthly-Challenges/challenge-1026/writeup.md)
27. [shiyuvi](https://gist.github.com/flyrio/12607ab4d94ea6ee0424a2e6d7ef3b2f)
28. [frank0pz](https://gist.github.com/frank0pz/87ed72b12b44e7eda92c030d5b7d5554)
29. [marsupilami](https://github.com/marsupilamiresearch-max/intigriti-october-2026-ctf-writeup)
30. [c7b3r8unny](https://noobhunter.hashnode.dev/preview/6ad8c715c35e407bf9ba1bf8)
31. [0xruh4n](https://medium.com/@ahsansarnav/from-666-to-0-breaking-coupon-logic-to-capture-the-flag-b1399fa6346a)
32. [issah721](https://github.com/Issah721/issah721.github.io)
33. [*m\_a\_s\_u\_m*](https://medium.com/@mollamasum764/from-666-to-0-breaking-the-coupon-flow-october-2026-intigriti-challenge-a3a0b7d42341?postPublishedType=initial)
34. [montu2003](https://medium.com/@Montu_bamborde/intigriti-october-challenge-1026-write-up-how-i-got-666-candy-for-0-using-http-parameter-803a4d8b8dc7)
35. [sk404](https://sk404lab.com/writeups/intigriti-ctf-1026.html)
36. [r4id\_](https://jorenverheyen.github.io/intigriti-october-2026.html)
37. [sel](https://selim-celebi.github.io/intigriti-1026-writeup/)
38. [immaarichguyy](https://ctf-writeups-webb.vercel.app/posts/intigriti-1026/)
39. [odin\_eye](https://venilton-dados.github.io/intigriti-challenge-1026-writeup/)
40. [unknown\_](https://github.com/angelo-martinez0/angelo-martinez0/blob/main/Writeups/Intigriti/challenge1026.md)
41. [grantzero](https://brambrinkmeier.com/writeups/halloween-store/interactive/)
42. [44x](https://medium.com/@blackmambaa/how-i-stole-a-666-midnight-vault-for-free-intigriti-october-2026-ctf-challenge-%EF%B8%8F-%EF%B8%8F-037df10ba3dc)
43. [testert1ng](https://testert1ng.medium.com/9ada3080879c)
44. [bhautik404](https://medium.com/@bhautikXploit/intigriti-october-2026-challenge-write-up-exploiting-coupon-stacking-4b771b12ef5a)
45. [krishna\_jonnagaddala](https://medium.com/@krishnajonnagaddala/a-666-eur-box-for-66-eur-c420971389a7/)
46. [rodrigoballescaba](https://github.com/rodrigoballescaba/intigriti-challenge-1026-writeup)
47. [cybernerd](https://assemmerzoug.github.io/ctf-writeups/intigriti/halloween-store-1026/)
48. [ad3sh](https://ad3.sh/writing/Intigriti-October-2026-Challenge-Writeup)
49. [1xf4lc0n](https://5r4z4.medium.com/how-i-exploited-a-coupon-logic-flaw-to-get-674-90-8ec5cbb9385f)
50. [0xst4rk007](https://medium.com/@0xst4rk007_37141/how-to-buy-a-666-collectible-for-free-40e9b837e069)
51. [h4x4n](https://medium.com/@h4x4n/from-666-to-0-exploiting-coupon-logic-in-intigriti-ctf-1026-733b07052dde)
52. [hackesteck](https://hackesteck-bb.github.io/intigriti-1026-writeup/)
53. [redshres123](https://midnight-vault-intigriti.netlify.app/)
54. [killjoy7](https://medium.com/@ajithprabhu15/how-i-solved-intigriti-challenge-1026-stacking-coupons-to-get-a-666-item-for-free-f750fc41a3f0)
55. [matanrob](https://dojo1026poc.vercel.app/)
56. [betabyte](https://betabyte.medium.com/38420b02c94a)
57. [hacksty](https://medium.com/@prayerskhristi/intigriti-october-challenge-2026-turning-two-legitimate-coupon-codes-into-a-free-checkout-aaf9b5095d33)
58. [djakjak](https://medium.com/@aljzayryaltrath/8c2c47bacf71)
59. [tatsumaki](https://medium.com/@t0rnad3/business-logic-flaw-coupon-stacking-via-inconsistent-checkout-failure-state-cwe-841-improper-ddd015e84431)
60. [obaskly](https://obaskly.medium.com/i-paid-0-euros-for-a-666-euro-box-of-candy-a-coupon-stacking-bug-in-intigritis-october-challenge-a0364b78abc7?sharedUserId=obaskly)
61. [azrael](https://www.devxsec.com/blog/4f6c2d91-8b73-4a0e-a5d4-c71e9f203b68-writeup/)
62. [joy\_123](https://moonlit-boba-3e0ce4.netlify.app/)
63. [beetlejuice](https://medium.com/@beetlejuice997/how-i-discovered-coupon-stacking-via-last-element-only-deduplication-allows-unlimited-discount-ae39f5d335a2)
64. [chsxthwik](https://privatebin.net/?ffc67d7af52e1791#2gUYMiaQuibZcUnWYyeoV1o5viXKm6MfdejqR3k8dk7u)
65. [bishal0x01](https://bishal0x01.medium.com/c56925e8e654)
66. [arifenmahfuz](https://mahfujwhh.medium.com/chaining-discount-coupons-to-obtain-a-product-for-free-intigriti-october-challenge-1026-3bcae3311715)
67. [h3ll0is3](https://n0un4.github.io/intigriti-1026-writeup/)
68. [sl4x](https://gist.github.com/sl4x0/9b6a6ed94a6aeeab9f8f3ade40af1a60)
69. [rawsid1106](https://siddheshphapale.tech/bug-bounty-ctf/intigriti-1026-coupon-stacking.html)
70. [onevilx](https://www.onevilx.tech/posts/intigriti-1026-coupon-stacking/)
71. [mianx](https://mianhizb.com/writeups/intigriti-challenge-1026-first-blood)
72. [usmankhan7327](https://medium.com/@usmankhan7327/how-i-bought-a-666-halloween-hamper-for-0-00-and-got-a-flag-instead-of-a-receipt-b314cccdf37b?sharedUserId=usmankhan7327)