Kraken Market | DeadEnd

[CIVØ]

Yo, what's good? CIVØ checkin' in.
Kraken Market—the most popular dope shop in Russia. Funny thing is, they've called themselves invincible n' untraceable more than once, yet they can't even protect their own site properly.

Quick technical pass on Kraken clearnet support stack. Academy + recruit + mirror dump. No onion core, just the open face.

TARGETS

Host | Role | Notes​

akrn.to | Academy | Next.js, buildId=development
klabor.cc | Recruit | /api/lead open
worker-kv.cloudkra1.workers.dev | Mirror dump | public JSON, CORS *
ckrn.to | Calc / stealth | PWA + IPFS
2km.es / slon*.to / slon*.at | Entry | CF + challenge




ACADEMY (akrn.to)​

​

- /api/users/auth/signup
- /api/users/auth/login
- /api/users/getMe
- /api/users/list/
- /api/users/search
- /api/chats
- /api/chats/send
- /api/chats/invite
- /api/chats/kick
- /api/guides
- /api/guides/all
- /api/guides_access/*
- /api/promo
- /api/promo/all
- /api/access/request/*
- /api/images/upload/
- /api/images/{uuid}
- /api/landing
- /api/cards

- Image IDOR confirmed:
GET /api/images/{uuid} returns JPEG without auth. UUIDs taken from public /api/landing.

- Auth gate consistent: unauthenticated private routes → {"code":401,"message":"Unauthorized 1"}
Signup/login → {"success":false,"code":403,"message":"Captcha not passed"}

- Rewrite present: /lib/socket → /lib/socketServer.js
- Page /users/[id] exists (IDOR candidate after session)

WORKER KV​

​

GET https://worker-kv.cloudkra1.workers.dev/
Returns live JSON: all current onions, clearnet mirrors, academy, calc, dark, Telegram bots, courier popup HTML.
CORS *. Read-only from client.

RECRUIT (klabor.cc)​

​

POST /api/lead
Accepts arbitrary JSON. No captcha. Nickname field accepts XSS / template / path-traversal strings.
Response on success: {"ok":true}
Data forwarded to operators’ Telegram.

PROOF SLOT (502):

https://imgur.com/a/xXanwdR

LEAD SPAM SCRIPT: 3 KB file on MEGA

SUMMARY​

- Academy running development build with full API map and source maps exposed
- Public Worker KV = live mirror & bot inventory
- Image IDOR on course materials
- Recruit lead endpoint accepts injection strings and has no captcha
- Private routes gated by session + captcha; no unauthenticated bypass found on checked paths


Contact: @civo_core01 (Telegram)