#include <stdio.h>

int main() {
    int i;
    for (i = 0; i < 10; i++) {
        puts("Hello, World!");
    }
}

## Directories (not case-sensitive)
> Currently scanning using */usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt*
* /search (Status: 200) [Size: 5285]
* /login (Status: 200) [Size: 1821]
* /register (Status: 200) [Size: 1959]
* /static (Status: 301) [Size: 179]

## Untried
* Fuzz Passwds
* Fuzz invalid invite code
* Type confusuion for params
* XXS
* Directory bust /static
* Testing other paramters (?country/?city/?address)
* Take found usernames and crossreference with public breaches

## Failed
* SQLMAP (search param)
* sqlmap register
* sqlmap login
* basic manual sql injection
* hacker uuid decoding (no reasonable correlation, all random?)
* Attempt to decode all UUIDs
* Bruteforce seclist top 10000 passwords on liber8tion_coffee_hacker
* Bruteforce seclist top 10000 passwords on script_kiddie
* Bruteforce seclist top 100 passwords on all users

## Questions

* Does handle = username ? (Probably)
* Are usernames in a public breach?
* Does handle % uuid = invite code ? or some other combination

## Interesting Finds
* Username must not be more than 32 characters
* Password must not be more than 32 characters
* InviteCode can be any length
* Login page accepts a "hire" parameter for GET requests (these params are v4 GUIDs/UUIDs)
* Uses nginx proxy again
* Searches with a single letter will pull up all users with that letter in their handle.
* Searches only find handles based on letters (cred will not find users)
* jquery (3.3.1) and lodash (version supposedly have vulnrabilities.
* Search is case sensitive.
* No uppercase or special chars in handles, only "_" and "." and digits

## Users
> script_kiddie (1337) may be a user of interest
>
| handle | cred | uuid |
| ---- | ---- | ---- |
|a_a_ron92|35814|b76c5d0e-5ea6-4554-b99d-4c3b279e53b0|
|adah93|85984|f1acabbb-4ef8-443c-9576-3d4bd49ae507|
|adam.rath|24097|588b955b-e23f-4153-aa55-9977a87e98c5|
|anastacio.corkery77|59252|234b42ad-d1d1-40e4-bcbb-354844a80ac6|
|andreane.harvey137|27145|2a69df66-9125-4364-8b27-cccf6443a670|
|angie14|69538|d938b044-f692-4536-846b-a57d5dd74ead|
|armani66|96948|53c8b8ac-cb57-4bc8-b08d-5a4c4c65ffb4|
|arnold_larson|63001|d1ab1c82-957b-4220-ab90-bb5588cf8190|
|augustine16|1148|324f2de3-c575-4db6-8002-9ca7fb71c993|
|benjamin6|93859|60bf11e7-3105-4a97-8a61-f817b3b86e8d|
|berry40|25363|3d8c373b-ed84-4e0a-8ef6-d177f6a6c19b|
|bethel_stark|20408|7a542f25-9d91-4ef7-9ab4-0e9e2069d8af|
|brian_langosh30|67776|06691f47-5643-4d36-b1fc-f771672d6106|
|chandler_konopelski|14510|907daa52-5e8f-4642-a8be-e5e430a335dc|
|charles14|5494|c5e8e0cc-46cc-4662-b06c-7436bbb30f48|
|cleo72|88479|4ee22a95-1eaa-4421-be9c-af0f9878186d|
|cordelia78|87745|f8c2de3c-0d9e-4b94-a3f5-c80590132397|
|creola39|94397|85e8ece0-bcf2-4cb0-b7e0-b6dbfc9fcf5e|
|cristobal.mertz62|43084|19c89042-8073-46a5-9883-8d771a8279d6|
|curtis56|31086|e4dfb1ee-23dc-4334-82fe-86b8cb12e61d|
|daren_bernier|46801|dd6664a5-267c-404c-8f12-fcf88a3fbb1f|
|deon_spinka|83171|0cf31d7b-f7f0-44ff-8a02-f674b2750b2d|
|deshaun_mills53|91103|7749be4d-d97d-4a63-8912-a1c1774947b6|
|diamond_macgyver13|55670|8578a02d-e9c7-49b8-bca8-4ee914e7f157|
|eldora85|38490|a04be0c3-d979-46a0-b01e-b7ad962fcc62|
|gerhard73|24285|71dff9e9-57d6-4508-a5fb-0f7cb9675629|
|heavymetal38|70026|da94dcc8-d76a-4ecf-b503-36d21514884f|
|ivah37|18975|83aa7e20-5443-45ad-9db6-23c3fb85ff63|
|jadyn68|55234|e609fce4-66e0-4fbf-956f-16f2094d0b6a|
|jany81|55982|8107fda2-28fb-422f-8ba3-fd83a45a2f43|
|jarrod_gerlach|12734|bc16d77a-4fee-40ac-bd29-36f5fd5225fd|
|jasmin_koelpin|41175|ae5c9f1d-9075-46d7-b6d0-5c834aabe0c8|
|jaydon45|26762|e66b10ca-f3bd-419e-8e1c-65839384099c|
|jerod_cormier78|20822|bea86e63-67bb-4ddb-81fc-17be89f77f5a|
|jessica_hax|18913|626a4908-0571-4185-b627-c6e48343adec|
|jillian71|68645|7d2eedad-63ed-4ee0-b5d6-5b089f8aa153|
|joannie.brekke24|84810|278e99da-9b76-4d89-b6b4-1f0859a6318a|
|joanny.witting|37572|586cdc0f-5ff1-4c4f-805b-15e2bd4ee134|
|jodie11|38495|0c900794-84f9-4469-b733-af1621f28b3c|
|johnny.kling77|12178|6d4deb65-cd8c-4ff9-8d2e-0b46eb6f120e|
|justine_kuhn|33932|53f373f8-15f5-40dc-bbc8-84204195891a|
|kailee61|2085|9890b183-924a-4579-904c-17cac59be50b|
|kailee_oreilly77|79431|2dc3148c-f486-4d14-a199-4dbfeae45f1f|
|kaitlyn_mraz|70796|2f39c520-4946-4d2a-a52c-fa222a61026b|
|katarina.bartell|36796|3f575094-8f1d-4ae3-9943-a56f4885ec16|
|keegan.schinner|7670|df459433-ecc8-48ba-bef8-d292cad3b443|
|keenan2|39819|4dceaed0-d441-4cd9-b9b4-af244e075cdc|
|kenyatta.torphy|61878|b0a5f466-e4c3-4ac9-87b5-e75cc56235fd|
|leta.gleason|65348|8ff49fb8-e034-4956-a8c8-fa90ab3e6873|
|liber8tion_coffee_hacker|134992240|ac040528-c392-42f6-ac07-893f8e6b1e65|
|linnea.romaguera|88874|6ef56392-1475-4c1d-9afd-34b59237c82a|
|lou_mayer14|41518|8b6a5d22-4a28-4ca1-874a-a76c45831172|
|loy_labadie22|61523|e45ba267-5b92-4a98-a4eb-d67632bc90f2|
|lucius70|79680|767e4c95-27dd-4c54-8f7c-a01da68b2fd3|
|luther.koss67|99034|608ab49d-4d1c-4bfe-917d-c8b0b61b9e99|
|madison_shields|94987|2ba8efe1-37c6-4639-bdee-891cabf043e3|
|magali19|58178|db5d51e7-3301-4b28-9216-36bd32815084|
|margie81|32989|40ebfe2d-4e69-4988-8f09-87e88d1ebc43|
|marley.herzog|44699|9ad69479-d2e2-4f51-ab3b-f31d938e6b6a|
|matilda0|18903|b5129ca4-358c-4242-bc99-4bde227ae91c|
|mckenzie_oconnell46|47536|77412502-ecf7-42d5-b4ae-f7583b85c392|
|milford.kub96|95615|f270c01b-50d1-46fd-9336-c7a5f8c5c6f4|
|monte55|70872|eb9c1028-1e4e-4b4d-9da2-234adaf656a3|
|monte_spencer|57444|952f4e8c-b43f-4a70-852e-17e86a508b81|
|myrl_langosh|74997|c850bdaf-6547-47bc-87bc-cc6697c311cb|
|myron_jenkins26|28594|4d003d92-9d5d-4404-8bd5-1ea798c9aab3|
|neil.stroman|661|e6dffc1f-bdbc-4ea3-9c95-7a45048fa1aa|
|nicholaus.fadel11|85727|23340388-c62e-4e77-8bc7-5b50778c51b0|
|norene_simonis|12362|732abbfc-3fc2-40cd-9b59-3a6ce69781a2|
|ofelia_jones18|62320|25d18564-1cf2-4aad-ad05-98b88e90f7f6|
|oliver.kreiger|17239|e0c4e0c7-8b9e-4afa-8c86-6714f0d8d605|
|paris.kertzmann28|25134|eaeb2a7a-572e-4d4c-b5ca-5ff5085ce2b0|
|pasquale.swift76|15253|b5c0a804-50de-4a56-8477-a0b9962d09a1|
|paxton_expli0ts|25382|370039a1-1b08-4ff6-bffe-ffd6194e3cac|
|percival.gutkowski|5769|84b50b09-5ff7-4bf2-87c3-f9a02589bc58|
|piper_nolan16|81751|e269ec22-f0c2-4e7b-9b6d-5df3e1623b05|
|princess1337|82840|abb3ed7a-79b9-47fe-a4f6-6e648fb3c104|
|pumpkin_pie|86327|47267b69-cc00-4d58-b4a3-1ff25178d91d|
|rafael_bartoletti|86274|50ed5308-6ea6-4c87-a6ae-1461071b6dcd|
|raoul2|2781|64cb8863-a856-4dcf-bc3f-5448358847f8|
|reese54|894|b27d6a83-be77-4540-8ccc-442569065fa3|
|roberto56|37527|9530e84a-a369-41ec-a4a8-945b3e4400aa|
|rodrick.cassin|80680|a03de01a-d980-4535-a167-4429d8960b9b|
|ron.muller|49190|778e47a9-5b40-4534-a056-bd28baff65b3|
|ronny.stehr38|83885|f498fa86-1d36-411d-b59f-1a3c79faea3a|
|rose_larkin|11385|be9624a1-f387-4dfc-b982-dc00d19b68ea|
|rosina.maggio|46927|356dad59-7998-4910-8a03-13d7132c7801|
|salvador_towne29|9759|f7b46586-5215-4de7-b181-af623b1846cf|
|scott_sterling|30541|82275362-89f7-423a-b15c-f60aeaa9d8c5|
|script_kiddie|1337|e8756f36-5520-4777-98eb-023ed7629bb0|
|soledad.rice|18392|e5fd37ab-e579-4da6-bae0-b4ef24291f40|
|sylvia7|41785|a3028f6f-f5bb-4c59-8b74-692d9e9f11a1|
|terence85|14848|1773b5a7-cda3-41cc-a66a-cbb77328218d|
|thora_lindgren25|98707|f95ed2e0-f482-4ef9-93ba-1916a5d63b9a|
|tyrell.hackett2|71479|33f387cf-1094-4220-a8b9-9706f1fe0ae9|
|vivian56|91821|0f6643a9-2d9e-4a05-be8c-8d67382554e6|
|whitney_scripts99|7277|b07c7866-8872-47df-b4c0-4dab6a8078e9|
|wilhelmine_sipes|24134|9d205a54-1a75-4e36-89ff-545ab862aa00|
|willis_schiller|89804|79d4bc38-3fdb-43c4-99fe-43200edaff20|
|winfield.green38|52710|bc25b1ad-f373-46f3-ba46-505848794114|

<br><br>