I only checked the first three, but they match exactly so that seems correct.I saw someone on another forum mention that the hashes in the HTML comments were changing based on IP address. So, I figured that the hash was the IP address plus some other string concatenated. I wrote some brute forcing code using the hashes I was getting and my IP address and I actually found some matches.
For me at least, each page's hash is being calculated as the MD5 of my IP address concatenated with a single character.
Here are the matches I found for each page:
Index: MD5(IP + 1)
Hours: MD5(IP + 2)
About: MD5(IP + b)
Menu: MD5(IP + z)
Beer: MD5(IP + a)
Privacy: MD5(IP + y)
Admin: MD5(IP + x)
Can somebody else confirm that the hashes you're seeing match this pattern?
So all the extra letters are:
12bzayx
Maybe these can be unscrambled for the username and/or password?
12abxyz maybe? *edit* No combinations of these letters in groups of in-order stuff (12, ab, xyz) seem to work.
*edit2* Crazy idea, those letters remind me of game controller letters. If there were some sort of game that's related, maybe pressing them on a keyboard or controller does something? Is there even a controller that has '1' and '2' in addition to ABXYZ?