Spot #1346 on the @B20Factory factory floor. BATCH 01.
run the checklist, claim yours ↓
ref B20-1346-9330
https://t.co/18y9vBQeTt
https://t.co/VvXOTxyXox
The bitcoin faucet is back はBitkey・Cash Appのプロモーションだそうです🐰💕
◆4月6日〜10日の間 or BTCプール100万ドルが尽きるまで
◆Cash Appで$10以上のBTC購入→$5報酬
◆Square加盟店でのBTC支払い→$25報酬
◆Bitkeyへのビットコイン移動→$50報酬
最大$80のBTCを受け取れる仕組み💰
Ok so.. they left their CDN exposed.
If you ping the domain, you get this ip:
151.101.129.49
It turns out this is a https://t.co/wqDjtIZMEy IP . I had never heard of fastly but it looked to be something similar to vercel, so I figured maybe they had custom deployment links like vercel does.
Tried a few different combos and BINGO:
https://t.co/VUGl0CQFJm
This took me to this:
https://t.co/EaQKYxNtOy
That’s their CDN bucket on AWS. They currently have it setup so that any invalid endpoints redirect back to index.html
I went on a hunch and figured that they’d probably already have their production app stored somewhere in the CDN ready for deployment
I used SECLISTs (https://t.co/gafGrACoMC )and ffuf to try out over 20k different combinations on this URL.
After some sleuthing, BINGO!! I found these two files:
> live.html
> .DS_STORE
The important one here that immediately caught my eye was “live.html”. That sounded like a prod deployment.
And sure enough, it was!
This is what the https://t.co/eY5zWkX10Z site will look like on the day the faucet goes live:
https://t.co/vXn9H24Gvj
https://t.co/M7ExI8pQym
It turns out the entire faucet will be revealed to just be a promotion scheme to get you to buy a bitkey and use cash app.
There is no faucet - at least in the sense most were expecting.