const path = require('path'); const express = require('express'); const { Sequelize, DataTypes } = require('sequelize'); const PORT = Number(process.env.PORT || 9100); const FLAG = process.env.FLAG || 'EQST{Fake}'; const sequelize = new Sequelize({ dialect: 'sqlite', storage: process.env.DB_PATH || ':memory:', logging: false, }); const User = sequelize.define('User', { username: { type: DataTypes.STRING, allowNull: false, }, metadata: { type: DataTypes.JSON, allowNull: false, }, }); const Flag = sequelize.define('Flag', { flag: { type: DataTypes.STRING, allowNull: false, }, }, { tableName: 'Flag', }); async function seedDatabase() { await sequelize.sync({ force: true }); await User.bulkCreate([ { username: 'minseo.jwa', metadata: { name: 'Minseo Jwa', role: 'Security Researcher', team: 'EQST', office: 'Seoul', department: 'Security', email: 'minseo.jwa@eqst.com' } }, { username: 'olivia.bennett', metadata: { name: 'Olivia Bennett', role: 'Frontend Developer', team: 'Team E', office: 'New York', department: 'Engineering', email: 'olivia.bennett@eqst.com' } }, { username: 'noah.sullivan', metadata: { name: 'Noah Sullivan', role: 'Backend Developer', team: 'Team E', office: 'Austin', department: 'Engineering', email: 'noah.sullivan@eqst.com' } }, { username: 'emma.carter', metadata: { name: 'Emma Carter', role: 'Security Engineer', team: 'Team Q', office: 'Boston', department: 'Security', email: 'emma.carter@eqst.com' } }, { username: 'liam.parker', metadata: { name: 'Liam Parker', role: 'DevOps Engineer', team: 'Team E', office: 'Seattle', department: 'Platform', email: 'liam.parker@eqst.com' } }, { username: 'ava.hughes', metadata: { name: 'Ava Hughes', role: 'HR Manager', team: 'Team T', office: 'Chicago', department: 'People', email: 'ava.hughes@eqst.com' } }, { username: 'elijah.cooper', metadata: { name: 'Elijah Cooper', role: 'Data Analyst', team: 'Team S', office: 'Austin', department: 'Analytics', email: 'elijah.cooper@eqst.com' } }, { username: 'sophia.ward', metadata: { name: 'Sophia Ward', role: 'Product Manager', team: 'Team T', office: 'New York', department: 'Product', email: 'sophia.ward@eqst.com' } }, { username: 'james.brooks', metadata: { name: 'James Brooks', role: 'QA Engineer', team: 'Team Q', office: 'Seattle', department: 'Quality', email: 'james.brooks@eqst.com' } }, { username: 'isabella.kelly', metadata: { name: 'Isabella Kelly', role: 'UI Designer', team: 'Team T', office: 'Los Angeles', department: 'Design', email: 'isabella.kelly@eqst.com' } }, { username: 'benjamin.reed', metadata: { name: 'Benjamin Reed', role: 'Mobile Developer', team: 'Team E', office: 'Boston', department: 'Engineering', email: 'benjamin.reed@eqst.com' } }, { username: 'mia.bailey', metadata: { name: 'Mia Bailey', role: 'Finance Manager', team: 'Team S', office: 'Chicago', department: 'Finance', email: 'mia.bailey@eqst.com' } }, { username: 'lucas.barnes', metadata: { name: 'Lucas Barnes', role: 'Recruiter', team: 'Team T', office: 'New York', department: 'People', email: 'lucas.barnes@eqst.com' } }, { username: 'amelia.cox', metadata: { name: 'Amelia Cox', role: 'Compliance Analyst', team: 'Team S', office: 'Boston', department: 'Security', email: 'amelia.cox@eqst.com' } }, { username: 'henry.foster', metadata: { name: 'Henry Foster', role: 'IT Support Specialist', team: 'Team Q', office: 'Austin', department: 'IT', email: 'henry.foster@eqst.com' } }, { username: 'harper.gray', metadata: { name: 'Harper Gray', role: 'Marketing Manager', team: 'Team T', office: 'Los Angeles', department: 'Marketing', email: 'harper.gray@eqst.com' } }, { username: 'alexander.hayes', metadata: { name: 'Alexander Hayes', role: 'Database Administrator', team: 'Team E', office: 'Seattle', department: 'Platform', email: 'alexander.hayes@eqst.com' } }, { username: 'evelyn.price', metadata: { name: 'Evelyn Price', role: 'Content Strategist', team: 'Team T', office: 'Chicago', department: 'Marketing', email: 'evelyn.price@eqst.com' } }, { username: 'daniel.long', metadata: { name: 'Daniel Long', role: 'Security Analyst', team: 'Team Q', office: 'Boston', department: 'Security', email: 'daniel.long@eqst.com' } }, { username: 'abigail.wood', metadata: { name: 'Abigail Wood', role: 'Technical Writer', team: 'Team S', office: 'Austin', department: 'Operations', email: 'abigail.wood@eqst.com' } }, { username: 'mason.powell', metadata: { name: 'Mason Powell', role: 'Sales Manager', team: 'Team S', office: 'New York', department: 'Sales', email: 'mason.powell@eqst.com' } }, { username: 'ella.patterson', metadata: { name: 'Ella Patterson', role: 'People Operations Partner', team: 'Team T', office: 'Chicago', department: 'People', email: 'ella.patterson@eqst.com' } }, { username: 'logan.russell', metadata: { name: 'Logan Russell', role: 'Cloud Architect', team: 'Team E', office: 'Seattle', department: 'Platform', email: 'logan.russell@eqst.com' } }, { username: 'scarlett.hamilton', metadata: { name: 'Scarlett Hamilton', role: 'Legal Counsel', team: 'Team S', office: 'Boston', department: 'Legal', email: 'scarlett.hamilton@eqst.com' } }, { username: 'jacob.graham', metadata: { name: 'Jacob Graham', role: 'Procurement Specialist', team: 'Team S', office: 'Chicago', department: 'Operations', email: 'jacob.graham@eqst.com' } }, { username: 'grace.simmons', metadata: { name: 'Grace Simmons', role: 'Research Engineer', team: 'Team Q', office: 'Austin', department: 'Security', email: 'grace.simmons@eqst.com' } }, { username: 'michael.bishop', metadata: { name: 'Michael Bishop', role: 'Full Stack Developer', team: 'Team E', office: 'New York', department: 'Engineering', email: 'michael.bishop@eqst.com' } }, { username: 'chloe.butler', metadata: { name: 'Chloe Butler', role: 'Office Manager', team: 'Team T', office: 'Los Angeles', department: 'Operations', email: 'chloe.butler@eqst.com' } }, { username: 'ethan.coleman', metadata: { name: 'Ethan Coleman', role: 'Account Executive', team: 'Team S', office: 'Chicago', department: 'Sales', email: 'ethan.coleman@eqst.com' } }, { username: 'lily.bryant', metadata: { name: 'Lily Bryant', role: 'Customer Success Manager', team: 'Team S', office: 'Boston', department: 'Customer Success', email: 'lily.bryant@eqst.com' } }, { username: 'william.jenkins', metadata: { name: 'William Jenkins', role: 'Infrastructure Engineer', team: 'Team E', office: 'Seattle', department: 'Platform', email: 'william.jenkins@eqst.com' } }, ]); await Flag.create({ flag: FLAG, }); } function buildApp() { const app = express(); app.use(express.json()); app.use(express.static(__dirname)); app.get('/', (_req, res) => { res.type('html').send(` CVE-2026-30951 by EQST Lab
EQST logo
CVE-2026-30951
by EQST Lab
Results
Ready.
Search results will appear here.
`); }); app.get('/healthz', async (_req, res) => { try { await sequelize.authenticate(); res.json({ ok: true }); } catch (error) { res.status(500).json({ ok: false, error: error.message }); } }); app.post('/api/users/search', async (req, res) => { const filter = req.body && typeof req.body.filter === 'object' ? req.body.filter : {}; try { let users; const filterKeys = Object.keys(filter); if (filterKeys.length === 1 &&filterKeys[0] === 'name'&& typeof filter.name === 'string') { const query = filter.name.trim().toLowerCase(); users = (await User.findAll({ order: [['username', 'ASC']], raw: true, })).filter((user) => { const metadata = typeof user.metadata === 'string' ? JSON.parse(user.metadata) : user.metadata; const haystacks = [ String(user.username || '').toLowerCase(), String(metadata.name || '').toLowerCase(), ]; return haystacks.some((value) => value.includes(query)); }); } else { users = await User.findAll({ where: { metadata: filter }, raw: true, logging: (sql) => { console.log(`SQL: ${sql}`); }, }); } res.json({ ok: true, count: users.length, users, }); } catch (error) { res.status(500).json({ ok: false, error: error.message, }); } }); return app; } async function initialize() { await seedDatabase(); return buildApp(); } async function main() { const app = await initialize(); app.listen(PORT, () => { console.log(`Challenge server listening on http://127.0.0.1:${PORT}`); }); } if (require.main === module) { main().catch((error) => { console.error(error); process.exit(1); }); } module.exports = { Flag, PORT, User, buildApp, initialize, sequelize, };