I tried to do a SQL injection on the invite code form and they blocked my IP for 15 min. I guess some technique's aren't allowed.

EDIT: Switched my target to the front-end and was able to get in pretty easily.