Ok so.. they left their CDN exposed.
If you ping the domain, you get this ip:
151.101.129.49
It turns out this is a https://t.co/wqDjtIZMEy IP . I had never heard of fastly but it looked to be something similar to vercel, so I figured maybe they had custom deployment links like vercel does.
Tried a few different combos and BINGO:
https://t.co/VUGl0CQFJm
This took me to this:
https://t.co/EaQKYxNtOy
That’s their CDN bucket on AWS. They currently have it setup so that any invalid endpoints redirect back to index.html
I went on a hunch and figured that they’d probably already have their production app stored somewhere in the CDN ready for deployment
I used SECLISTs (https://t.co/gafGrACoMC )and ffuf to try out over 20k different combinations on this URL.
After some sleuthing, BINGO!! I found these two files:
> live.html
> .DS_STORE
The important one here that immediately caught my eye was “live.html”. That sounded like a prod deployment.
And sure enough, it was!
This is what the https://t.co/eY5zWkX10Z site will look like on the day the faucet goes live:
https://t.co/vXn9H24Gvj
https://t.co/M7ExI8pQym
It turns out the entire faucet will be revealed to just be a promotion scheme to get you to buy a bitkey and use cash app.
There is no faucet - at least in the sense most were expecting.
@youdoubro Trying out my Zashi wallet, Thank you
u18843ayf4tzu4f3haxmnt76g9uqughyqkm3ccletxamyf5tzl3s832hq8qr2py0rcsl8te7j030nld2a0cm56mtza0k8zwe7uye38u7rxjwqwsugz0255ee8wur8twh32q9cah53scs20ghsmdwvagfc8fcdr8z8ja2je9mwyqc0ajhud
The left kills the CEO of United Healthcare
Kills two Israeli ambassadors staffers
Attempts twice to assassinate the President
Doxes and attempts to murder federal ICE agents and Police - all week
And now kills a MN state rep and her husband and injures a Senator and his wife
The left has become a full blown domestic terrorist organization.