import requests

S = "https://regtest846.alwaysdata.net/"

def probe(path, body, ct):
    r = requests.post(S + path, data=body, headers={"Content-Type": ct}, timeout=20)
    return r.status_code, len(r.content), r.text[:90].replace("\n", " ")

print("=== FINDING-1: JSON CT bypass (WAF=full) ===")
xss = '{"q":"<script>alert(1)</script>"}'
sqli = """{"q":"x' OR 1=1-- -"}"""
lfi = '{"file":"/etc/passwd"}'
tests = [
    ("XSS json", xss, "application/json", "vuln.php"),
    ("XSS urlenc", xss, "application/x-www-form-urlencoded", "vuln.php"),
    ("SQLi json", sqli, "application/json", "vuln.php"),
    ("SQLi urlenc", sqli, "application/x-www-form-urlencoded", "vuln.php"),
    ("LFI json", lfi, "application/json", "read.php"),
    ("LFI urlenc", lfi, "application/x-www-form-urlencoded", "read.php"),
]
for name, body, ct, path in tests:
    c, l, t = probe(path, body, ct)
    print(f"{name:16s} {c} {l:5d}B  {t}")

print()
print("=== FINDING-2: XML partial bypass ===")
xxe = '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><q>&xxe;</q>'
xml_script = "<q><script>alert(1)</script></q>"
xml_sql = """<q>x' OR 1=1-- -</q>"""
xml_urlenc = "x%27+OR+1=1--+-"
tests2 = [
    ("XXE xml", xxe, "application/xml", "vuln.php"),
    ("script xml", xml_script, "application/xml", "vuln.php"),
    ("sql xml", xml_sql, "application/xml", "vuln.php"),
    ("sql urlenc", xml_urlenc, "application/x-www-form-urlencoded", "vuln.php"),
]
for name, body, ct, path in tests2:
    c, l, t = probe(path, body, ct)
    print(f"{name:16s} {c} {l:5d}B  {t}")