---

T="http://task.duckerz.ru:21046"
BID="JJN36yMfd5yB9oQiq_ZJw"

echo "===== 1. Старые страницы ====="
for p in /old-admin /admin-old /old /v1/admin /api/v1/admin /legacy \
         /old-login /backup /admin.bak /admin_old /panel /dashboard \
         /cp /console /manage /editor /redactor; do
  echo -n "$p -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code} %{redirect_url}\n" "$T$p"
done

echo "===== 2. Старое API ====="
for p in /api/v1/login /api/v1/admin /api/old/login /api/legacy \
         /api/v0/login /old-api/login /api/admin/login /api/auth/login \
         /api/signin /api/session /api/token /api/auth; do
  echo -n "$p -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code}\n" "$T$p"
done

echo "===== 3. Бэкапы и утечки ====="
for f in /admin.bak /admin.old /admin.zip /admin.tar.gz /admin.sql \
         /backup.zip /backup.tar.gz /backup.sql /site.zip /www.zip \
         /portal.zip /portal.tar.gz /source.zip /src.zip \
         /.git/config /.git/HEAD /.env /.env.bak \
         /package.json /Dockerfile /docker-compose.yml; do
  code=$(curl -s -o /dev/null --max-time 5 -w "%{http_code}" "$T$f")
  size=$(curl -s -o /dev/null --max-time 5 -w "%{size_download}" "$T$f")
  [ "$code" != "404" ] && [ "$code" != "000" ] && echo "!!! $f -> $code ($size)"
done

echo "===== 4. Методы на /api/login ====="
for m in GET PUT DELETE PATCH OPTIONS; do
  echo -n "$m -> "
  curl -s -o /dev/null --max-time 5 -w "%{http_code}\n" -X $m "$T/api/login"
done

echo "===== 5. Чанки app/admin, app/login, pages/* ====="
for f in \
  "/_next/static/chunks/app/admin/page.js" \
  "/_next/static/chunks/app/admin/page.js.map" \
  "/_next/static/chunks/app/admin/layout.js" \
  "/_next/static/chunks/app/login/page.js" \
  "/_next/static/chunks/app/login/page.js.map" \
  "/_next/static/chunks/pages/_app.js" \
  "/_next/static/chunks/pages/_app.js.map" \
  "/_next/static/chunks/pages/_error.js" \
  "/_next/static/chunks/pages/admin.js" \
  "/_next/static/chunks/pages/admin.js.map" \
  "/_next/static/chunks/pages/login.js" \
  "/_next/static/chunks/pages/login.js.map" \
  "/_next/static/chunks/pages/dashboard.js" \
  "/_next/static/chunks/pages/panel.js" \
  ; do
  code=$(curl -s -o /dev/null --max-time 5 -w "%{http_code}" "$T$f")
  size=$(curl -s -o /dev/null --max-time 5 -w "%{size_download}" "$T$f")
  echo "$f -> $code ($size)"
done

echo "===== 6. Флаг в служебных файлах ====="
for f in /robots.txt /sitemap.xml /package.json /.env /config.json \
         /_next/static/$BID/_buildManifest.js; do
  echo "--- $f ---"
  curl -s --max-time 5 "$T$f" | grep -oE "DUCKERZ\{[^}]*\}|admin|secret|flag" | sort -u | head -10
done

echo "===== DONE ====="