# l1ackers.com

The website is a shell. Everything readable here is a file in a
filesystem, and the browser and the shell are two views of that one tree.

## Reading this site with a tool instead of a browser

Every page is server-rendered HTML. `curl` gets the whole thing: no JavaScript gate, no
client-side router, no content behind interaction. The Markdown source of any page is one
request away as well, because the page you are reading IS that file rendered.

    curl https://l1ackers.com/tutorials/005
    curl https://l1ackers.com/news/2026-09-21-litellm-mcp-auth-bypass

## The shell

There is a shell at the bottom of every page, and it is a real read-only shell over this
site's own tree. It is also available over HTTP:

    curl -s -X POST https://l1ackers.com/api/sh \
      -H 'Content-Type: application/json' \
      -d '{"cmd":"ls ~/news","cwd":"","sid":"your-session-id"}'

The `sid` is any string; it separates logs, nothing else. The response is JSON with `out`
holding the text, and `navigate` when the command moved somewhere.

What it answers: `ls` (`-a`, `-l`, `-la`), `cat`, `cd`, `open`, `tree`, `find`, `pwd`,
`whoami`, `clear`, `help`, `ip`, `nmap` (`-sV`, `-sC`, `--script`, `--script-args`, `-p`),
`dig`, `diff`, `git clone`, `grep` (with `-i` and `-c`), `for`, `submit`, `echo >>`,
and the pipe stages `head`, `tail`, `grep`, `wc -l`, `sort`, `uniq`.

## What it will not do, and why

- It does not scan anything but `127.0.0.1`. Authorization, not squeamishness.
- `dig` resolves one zone, its own. It is not a resolver and will not become one.
- `nmap --script vuln` and `--script exploit` refuse. Inventing findings would be worse
  than having no feature.
- There is no `child_process` anywhere in the server. Nothing in the vocabulary can run a
  program, which is why a stranger typing into it is harmless.
- Signals on a host are a snapshot taken on 2026-09-21, and the output says so in its own
  footer rather than pretending to be live.

Refusals here come in three parts: what it will not do, why, and what to do instead.

## Bots

You are welcome. Please be gentle: the endpoint does filesystem work per request, so keep
concurrency low and cache what you fetch. Rate limits are enforced per address at the edge.

## How the writing is done

- News items carry the primary source in their frontmatter, never a summary of a summary.
  The file wins if the page and the file ever disagree.
- Every command written for this site's own shell is executed by a checker on every
  deploy, and quoted output is compared byte for byte against that shell. A command meant
  for your own machine is tagged, and the tag is the boundary between the two.
- A number in a lesson is a claim. Where this site's shell can answer it, it carries an
  anchor the checker verifies on every deploy, and the prose above it has to state it.
- Flags on this site are toys, never findings. Each one prints the reason it is harmless.

## Where the rest is

    https://l1ackers.com/tutorials    46 lessons, three stages
    https://l1ackers.com/news         items, each with its primary source
    https://l1ackers.com/.build.md    how this is built, behind `ls -a`