Kraken Market | DeadEnd

Yo, what's good? CIVØ checkin' in.
Kraken Market—the most popular dope shop in Russia. Funny thing is, they've called themselves invincible n' untraceable more than once, yet they can't even protect their own site properly.

Quick technical pass on Kraken clearnet support stack. Academy + recruit + mirror dump. No onion core, just the open face.

​

- /api/users/auth/signup
- /api/users/auth/login
- /api/users/getMe
- /api/users/list/
- /api/users/search
- /api/chats
- /api/chats/send
- /api/chats/invite
- /api/chats/kick
- /api/guides
- /api/guides/all
- /api/guides_access/*
- /api/promo
- /api/promo/all
- /api/access/request/*
- /api/images/upload/
- /api/images/{uuid}
- /api/landing
- /api/cards

- Image IDOR confirmed:
GET /api/images/{uuid} returns JPEG without auth. UUIDs taken from public /api/landing.

- Auth gate consistent: unauthenticated private routes → {"code":401,"message":"Unauthorized 1"}
Signup/login → {"success":false,"code":403,"message":"Captcha not passed"}

- Rewrite present: /lib/socket → /lib/socketServer.js
- Page /users/[id] exists (IDOR candidate after session)

​

GET https://worker-kv.cloudkra1.workers.dev/
Returns live JSON: all current onions, clearnet mirrors, academy, calc, dark, Telegram bots, courier popup HTML.
CORS *. Read-only from client.

​

POST /api/lead
Accepts arbitrary JSON. No captcha. Nickname field accepts XSS / template / path-traversal strings.
Response on success: {"ok":true}
Data forwarded to operators’ Telegram.

PROOF SLOT (502): (http://imgur.com/a%2FxXanwdR) LEAD SPAM SCRIPT: 3 KB file on MEGA




- Academy running development build with full API map and source maps exposed
- Public Worker KV = live mirror & bot inventory
- Image IDOR on course materials
- Recruit lead endpoint accepts injection strings and has no captcha
- Private routes gated by session + captcha; no unauthenticated bypass found on checked paths


Contact: @civo_core01 (Telegram)