[0x0539]

Everything you need to figure it out is on the login page.

Consider how hackernews works, there is the login page but that is not the only means to authenticating. You don't after all have to type your user/pass out for every page request.

[nint22]

Thanks for the tip! I'll be attacking this again tonight, I think I have an idea now that you mention auth. By the way, some subdomains are public (not sure if part of the game), like source.0x0539.com, oxidized etc.

Awesome work, thanks for the fun!

Edit: Just got past login, what an awesome puzzle. That being said, I hate that it looks like I have a run an executable from your site. Seems dangerous, so now I have to spend the time getting a VM setup.

[0x0539]

You don't have to run the executable. You can, but the problem is absolutely doable without running it (static reversing).

As for the subdomains, you can safely ignore them. There are a number of them most are not primarily mine. I just give some friends free hosting(or point subdomains to their boxes)

And yea there are random subdomains that are not part of it. Most of the subdomains are not even mine (I give free hosting to friends). The only subdomain that was part of it was clcs.0x0539.net but thats no longer the case.

[nint22]

Thanks so much for all of the clarification; it's really helpful to know I don't have to execute the app in question. I'll keep going down the rabbit hole, hopefully others find this site and enjoy it.