La cara de tonto de Abascal.

chupamelapolla.py








#!/usr/bin/env python3
import sys
import re
import time
import urllib.parse
from bs4 import BeautifulSoup
from curl_cffi import requests
from playwright.sync_api import sync_playwright

TARGET_URL = "https://qaa.booking.priceline.com"

HEADERS = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8",
    "Accept-Language": "es-ES,es;q=0.9,en;q=0.8",
}

PATRONES_ENDPOINTS = [
    re.compile(r"['\"`](/(?:api|v[0-9]|internal|graphql|auth|debug|c360|sink|report)/[a-zA-Z0-9_\-/]+)['\"`]", re.IGNORECASE),
    re.compile(r"['\"`](https?://[a-zA-Z0-9\-\.]+(?:/[a-zA-Z0-9_\-/]+)+)['\"`]", re.IGNORECASE)
]

def obtener_html_y_cookies_con_playwright(url_base):
    print(f"[*] Iniciando navegador autónomo para superar el reto AWS WAF...")
    try:
        with sync_playwright() as p:
            browser = p.chromium.launch(headless=True)
            context = browser.new_context(
                user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
            )
            page = context.new_page()
            
            print(f"[*] Cargando {url_base}...")
            page.goto(url_base, wait_until="networkidle", timeout=30000)
            
            # Margen para que el WAF resuelva el desafío criptográfico y cargue el DOM
            time.sleep(6)
            
            html_inicial = page.content()
            cookies_raw = context.cookies()
            browser.close()
            
            cookies_dict = {c['name']: c['value'] for c in cookies_raw}
            return html_inicial, cookies_dict
            
    except Exception as e:
        print(f"[!] Error ejecutando Playwright: {e}")
        return None, {}

def extraer_endpoints_de_script(session, url_js):
    endpoints = set()
    try:
        response = session.get(url_js, headers=HEADERS, timeout=10)
        if response.status_code != 200:
            return endpoints
        contenido = response.text
        for patron in PATRONES_ENDPOINTS:
            matches = patron.findall(contenido)
            for m in matches:
                if len(m) > 3 and not m.endswith(('.js', '.css', '.png', '.jpg', '.ico', '.woff2')):
                    endpoints.add(m)
    except:
        pass
    return endpoints

def probar_endpoint(session, url_base, endpoint):
    target = endpoint if endpoint.startswith("http") else urllib.parse.urljoin(url_base, endpoint)
    resultados = []
    
    for metodo in ["GET", "POST", "OPTIONS"]:
        try:
            if metodo == "GET":
                res = session.get(target, headers=HEADERS, timeout=5, allow_redirects=False)
            elif metodo == "POST":
                res = session.post(target, headers=HEADERS, timeout=5, allow_redirects=False)
            elif metodo == "OPTIONS":
                res = session.options(target, headers=HEADERS, timeout=5, allow_redirects=False)
            
            if res.status_code not in [404, 403]:
                resultados.append((metodo, res.status_code))
        except:
            pass
    return target, resultados

if __name__ == "__main__":
    print(f"[*] GodOfLima Playwright Bypass Suite para: {TARGET_URL}\n")
    
    html_inicial, cookies = obtener_html_y_cookies_con_playwright(TARGET_URL)
    
    if not html_inicial or not cookies:
        print("[-] No se pudo superar el reto o recuperar contenido.")
        sys.exit(1)
        
    print(f"[+] ¡Reto superado! Se obtuvieron {len(cookies)} cookies de sesión.")
    
    soup = BeautifulSoup(html_inicial, 'html.parser')
    urls_js = set()
    for script in soup.find_all('script', src=True):
        src = script['src']
        urls_js.add(urllib.parse.urljoin(TARGET_URL, src))
        
    lista_js = list(urls_js)
    print(f"[+] Total de archivos JavaScript descubiertos: {len(lista_js)}")
    
    if not lista_js:
        print("[-] No se encontraron scripts en la página principal tras el bypass.")
        sys.exit(1)
        
    session = requests.Session(impersonate="chrome120")
    for name, value in cookies.items():
        session.cookies.set(name, value, domain="priceline.com")
        
    endpoints_totales = set()
    print("[*] Analizando scripts en busca de rutas ocultas...")
    
    for idx, js_url in enumerate(lista_js, 1):
        print(f"    -> Analizando script {idx}/{len(lista_js)}", end="\r")
        rutes = extraer_endpoints_de_script(session, js_url)
        endpoints_totales.update(rutes)
        
    print(f"\n[+] Endpoints y rutas únicas descubiertas: {len(endpoints_totales)}")
    print("[*] Probando accesibilidad y métodos HTTP...\n")
    
    hallazgos_activos = 0
    for ep in sorted(endpoints_totales):
        target_url, respuestas = probar_endpoint(session, TARGET_URL, ep)
        if respuestas:
            print(f"    [!] {target_url}")
            for met, code in respuestas:
                print(f"        -> Método: {met} | Estado HTTP: {code}")
            hallazgos_activos += 1

    print(f"\n[*] Auditoría completada. Endpoints con respuesta activa/relevante: {hallazgos_activos}")