autoreg-skills-max: initial public release (restored, redacted, hardened)
This commit is contained in:
baradok60915d52e8425
113
skills/account-validation/references/discourse-login.md
Normal file
113
skills/account-validation/references/discourse-login.md
Normal file
@@ -0,0 +1,113 @@
|
||||
# Discourse Forum Login Reference
|
||||
|
||||
## Pattern
|
||||
Discourse-based forums use a simple form login. No CSRF token required for most instances.
|
||||
|
||||
## Login Endpoint
|
||||
```
|
||||
POST https://<domain>/login
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
|
||||
username=<username>&password=<password>&redirect=/
|
||||
```
|
||||
|
||||
## ⚠️ CRITICAL — Modern Discourse (2026.7.0+) JS-Only Auth
|
||||
|
||||
**NodeLoc (Discourse 2026.7.0-latest) cannot be verified via Python `requests` or `curl`.**
|
||||
|
||||
- Server sets **NO cookies via HTTP headers** (no `Set-Cookie`).
|
||||
- Both success and failure return `HTTP 302 → /` with **byte-identical HTML** (101,958 bytes).
|
||||
- Only difference: `discourse-track-view-session-id` meta tag (random session ID, not auth).
|
||||
- `logout` string is in homepage source **even when NOT logged in** — false positive.
|
||||
- Auth session is managed entirely via JavaScript-set cookies.
|
||||
|
||||
### CORRECT — Browser-Only Verification
|
||||
1. Navigate to `/login`
|
||||
2. Fill username + password, submit
|
||||
3. Success: rendered page shows `"欢迎回来，USERNAME！"`
|
||||
4. Failure: stays on `/login` with `"Неверное имя пользователя, адрес электронной почты или пароль"`
|
||||
5. Rate limit: ~17 requests → HTTP 429
|
||||
|
||||
### FAST PRE-CHECK — User Existence (works with curl!)
|
||||
```python
|
||||
# Check if user exists — no auth needed, no rate limit issues
|
||||
r = requests.get(f'https://www.nodeloc.com/u/{username}', allow_redirects=True)
|
||||
# 200 + '/u/username' in URL = user exists
|
||||
# 404 = user does not exist (skip login attempt entirely)
|
||||
```
|
||||
This eliminates ~40% of login attempts instantly (many usernames in dumps are fake).
|
||||
|
||||
### Session Management
|
||||
- **Logout**: `GET /session/logout` → returns 404 page BUT destroys the session cookie. Check header for "Войти" (Login) link.
|
||||
- **No CSRF token** needed for login form POST.
|
||||
|
||||
## Public API (no auth required)
|
||||
|
||||
```bash
|
||||
# Latest topics
|
||||
curl -s 'https://www.nodeloc.com/latest.json'
|
||||
|
||||
# Topic content
|
||||
curl -s 'https://www.nodeloc.com/t/{id}.json'
|
||||
|
||||
# Search
|
||||
curl -s 'https://www.nodeloc.com/search.json?q=KEYWORD'
|
||||
|
||||
# User profile (404 = user doesn't exist)
|
||||
curl -s -o /dev/null -w '%{http_code}' 'https://www.nodeloc.com/u/{username}'
|
||||
```
|
||||
|
||||
## Known Discourse Sites (updated 2026-07-22)
|
||||
|
||||
### Discourse API Accessible (curl works)
|
||||
| Site | URL | Topics |
|
||||
|------|-----|--------|
|
||||
| **NodeLoc** | nodeloc.com | 337+ AI abuse topics |
|
||||
| **V2EX** | v2ex.com | Custom API (`/api/topics/`) |
|
||||
| **OpenAI Community** | community.openai.com | Jailbreak, bypass, Codex |
|
||||
| **HuggingFace** | discuss.huggingface.co | 88 uncensored/jailbreak topics |
|
||||
| **Fly.io** | community.fly.io | LLM API abuse |
|
||||
| **NVIDIA Dev** | forums.developer.nvidia.com | GPU/AI |
|
||||
| **Docker** | forums.docker.com | AI containers |
|
||||
| **Python Discuss** | discuss.python.org | LLM/API |
|
||||
| **OpenWrt** | forum.openwrt.org | Networking |
|
||||
| **TechPowerUp** | techpowerup.com/forums | Hardware/AI |
|
||||
| **Level1Techs** | forum.level1techs.com | VPS/AI |
|
||||
| **Ubuntu** | discourse.ubuntu.com | Linux |
|
||||
| **Manjaro** | forum.manjaro.org | Linux |
|
||||
| **EndeavourOS** | forum.endeavouros.com | Linux |
|
||||
| **OpenSUSE** | forums.opensuse.org | Linux |
|
||||
| **MikroTik** | forum.mikrotik.com | Networking |
|
||||
| **Ubiquiti** | community.ui.com | Networking |
|
||||
|
||||
### Cloudflare/Blocked (need browser or FlareSolverr)
|
||||
| Site | URL | Platform | Notes |
|
||||
|------|-----|----------|-------|
|
||||
| **Linux.do** | linux.do | Discourse | 🔥 #1 AI abuse forum |
|
||||
| **NodeSeek** | nodeseek.com | Discourse | VPS hosting |
|
||||
| **LowEndTalk** | lowendtalk.com | Discourse | VPS |
|
||||
| **WebHostingTalk** | webhostingtalk.com | Custom | Hosting |
|
||||
| **NamePros** | namepros.com | Custom | Domains |
|
||||
| **XSS.is** | xss.is | Discourse | Russian hacking |
|
||||
| **Lolz.live** | lolz.live | Discourse | Russian marketplace |
|
||||
| **Zelenka.guru** | zelenka.guru | Discourse | Russian marketplace |
|
||||
| **Cloudflare** | community.cloudflare.com | Discourse | CDN/workers |
|
||||
| **Linode** | forums.linode.com | Discourse | VPS |
|
||||
|
||||
### Other Platforms (not Discourse)
|
||||
| Site | URL | Platform | Notes |
|
||||
|------|-----|----------|-------|
|
||||
| **HostLoc** | hostloc.com | Discuz! | Chinese VPS, AI proxies |
|
||||
| **奶昔论坛** | cn.naixi.net | Discuz! | Chinese MJJ community |
|
||||
| **大佬论坛** | dalao.net | Custom | Domains, VPS |
|
||||
| **恩山无线** | right.com.cn | Discuz! | Routers, OpenWrt |
|
||||
| **LowEndSpirit** | lowendspirit.com | Custom | VPS |
|
||||
| **4PDA** | 4pda.to | Custom | Russian mobile/software |
|
||||
| **Ru-Board** | forum.ru-board.com | Custom | Russian IT/hacking |
|
||||
| **Leak.sx** | leak.sx | Custom | Data leaks |
|
||||
| **RaidForums** | raidforums.com | Custom | Data leaks |
|
||||
| **Lobsters** | lobste.rs | Custom | Invite-only programming |
|
||||
| **Tildes** | tildes.net | Custom | Invite-only tech |
|
||||
|
||||
## Forum Discovery Source
|
||||
- **small-forums-list**: `https://github.com/Amiyadesi/small-forums-list` — curated list of 49+ niche forums. Online page: `https://forums.cc.cd/`. Categories: Tech/AI, VPS, Security, ACG, Hardware, Adult/Grey.
|
||||
Reference in New Issue
Block a user