Skip to content

Pentest Report

Website security research and canon connections documented.


Summary

All "password protected" URLs were accessible without passwords. Website is canonically connected to the show via wacky-watch.c file in Episode 8.


Accessible URLs

Main Pages

  • / - Main page (static/glitch state)
  • /cainepaint - Caine Paint character creator

Voting Pages (16+ accessible)

  • /vote1 through /vote41-1 - All accessible

Nominee Pages (7 total)

  • /nominees-caine
  • /nominees-gangle
  • /nominees-jax
  • /nominees-kinger
  • /nominees-pomni
  • /nominees-ragatha
  • /nominees-zooble

Redirects

  • /vote4/blank/gfdjflkdfjldkfj3l4kj23l
  • /test/blank/gfdjflkdfjldkfj3l4kj23l

Password Protection Bypass

Reddit Claimed: Vote pages were password protected Reality: ALL accessible without passwords

URLStatus
/vote1200 OK
/vote2-1200 OK
/vote3-1200 OK
/vote5200 OK
/vote41-1200 OK

Conclusion: Protection was removed or never existed.


Technical Details

PropertyValue
ServerPepyaka (Wix)
FrameworkWix Thunderbolt v1.17066.0
Site Revision449
Meta Site IDa1cf4e21-d817-4499-bb28-a3068ac7f4ee
Site ID97cca37d-dc5e-4379-8787-7c657a4685bc
User IDb483616e-649c-444c-9898-e3d192b7eac9
Asset Prefixb48361_

Archive History

DateContent
Oct 9, 2023First capture (redirect only)
Sep 26, 2024First real content (Mildenhall era)
Nov 30, 2024Spudsy's menu archived
2025Award show era (vote pages)
Mar 2026Current state (static/glitch)

Canon Connection Confirmed

Episode 8 terminal reveals wacky-watch.c exists in Caine's file system:

/secured/
├── caine-core.lisp [Oct 15, 1996]
├── paraphernalia-engine.dat [Oct 15, 1996]
├── [Scratch].dat [Oct 15, 1999]
├── [Ragatha].dat [Oct 15, 2008]
├── wacky-watch.c [Oct 15, 1996] ← THE WEBSITE
└── bubble-chef.lisp [Oct 15, 1996]

THE WEBSITE IS CANONICALLY PART OF THE SHOW.


Spudsy's Menu (Archived)

ItemPriceNotes
The Slab$50"Carefully curated human meat"
Dobby Dog$57.57Yellow dog = abstracted character
Vegan Meat$70Pickles
Sour Cream$0.31Left out 30 hours

Hidden: Exit door image links to Gooseworx Twitter post


404 URLs (Confirmed Non-Existent)

/admin, /api, /secret, /hidden, /debug, /dev
/caine, /pomni, /jax, /ragatha, /gangle, /kinger, /zooble
/bubble, /exit, /abstracted, /void, /circus, /adventure
/spudsys, /mildenhall, /game, /paint, /door
/job, /start, /57, /paraphernalia, /abstract

Wix Static Assets

Pattern: https://static.wixstatic.com/media/b48361_[hash]~mv2.[ext]

Examples discovered:

  • b48361_0d6e99f1fcbb4eabaa8766cd53978774 - Glitch logo
  • b48361_67690d55c473451b9cdafc062ad821e1 - Spudsy's menu item
  • b48361_b4724c0f49c64e6d9219e600930019d8 - Exit door image

robots.txt

User-agent: *
Allow: /
Disallow: *?lightbox=
Disallow: /_partials*
Disallow: /pro-gallery-webapp/v1/galleries/*

User-agent: PetalBot
Disallow: /

Key Findings

  1. ✅ All vote URLs accessible without passwords
  2. ✅ Website is CANON via wacky-watch.c
  3. ✅ Spudsy's menu has $57.57 Dobby Dog (57 reference)
  4. ✅ Sitemap only shows 2 pages (others hidden from SEO)
  5. ✅ Site in static/glitch state since March 2026
  6. ✅ Archive.org has full history from Sep 2024

Research Archive for The Amazing Digital Circus