#!/usr/bin/env python3
import concurrent.futures, json, requests, urllib3, time
urllib3.disable_warnings()
HOSTS=['mein-portal.baloise.de','mein-portal-registrierung.baloise.de','infoportal.baloise.de','maklerportal.baloise.de','si-portal.baloise.de','vertriebsservice.baloise.de','zeus-portal.baloise.de']
CANDS=[x.strip() for x in open('work/scratch/next/as-candidates.txt') if x.strip()]
IDENT={'X-Bug-Bounty':'dwbzn'}
def one_host(h):
    s=requests.Session(); s.verify=False; s.headers.update(IDENT)
    recs=[]
    try:
        g=s.get(f'https://{h}/auth/',timeout=15,allow_redirects=False)
    except Exception as e:
        return [{'host':h,'stage':'get','error':repr(e)}]
    tok=s.cookies.get('CSRFT759-S') or s.cookies.get('CSRFT759')
    hdr={'Content-Type':'application/json','X-Same-Domain':'1'}
    if tok: hdr['X-CSRFT759']=tok
    for c in CANDS:
        u=f'https://{h}/auth/rest/public/tech-client-registration/oauth2/{c}/register'
        t=time.time()
        try:
            r=s.post(u,headers=hdr,json={},timeout=15,allow_redirects=False)
            rec={'host':h,'id':c,'status':r.status_code,'size':len(r.content),'location':r.headers.get('Location',''),'body':r.text[:400],'elapsed':round(time.time()-t,3)}
        except Exception as e:
            rec={'host':h,'id':c,'error':repr(e),'elapsed':round(time.time()-t,3)}
        recs.append(rec)
        if rec.get('status') not in (404,):
            # keep going: distinct valid IDs may exist
            pass
    return recs
allrecs=[]
with concurrent.futures.ThreadPoolExecutor(max_workers=len(HOSTS)) as ex:
    for recs in ex.map(one_host,HOSTS): allrecs.extend(recs)
with open('work/scratch/next/dcr-as-enum-session.jsonl','w') as f:
    for x in allrecs: f.write(json.dumps(x)+'\n')
for x in allrecs:
    if x.get('status') != 404:
        print(json.dumps(x))