package recon

import "github.com/Armur-Ai/Pentest-Swarm-AI/internal/pipeline"

// hackazonProfile is the REST API surface of Hackazon (rapid7/hackazon), a
// realistic vulnerable online store (PHP). Alongside its injectable web shop
// (SQLi/XSS on search and product pages, which recon's crawl + sqlmap/dalfox
// cover), Hackazon ships a REST API under /api that carries classic BOLA on
// cart/order/user resources. Routes verbatim from web/swagger.json.
//
// AUTH: GET /api/auth with HTTP Basic credentials returns a session token;
// send it on later requests per the API's scheme (confirm the header from a
// live response). The web shop additionally uses a PHP session cookie.
var hackazonProfile = apiProfile{
	name: "hackazon",
	// /api/product and /api/category are always-mounted list routes (200) and
	// 404 on an unrelated app that passes the negative control.
	signatures: []signatureRoute{
		{method: "GET", path: "/api/product"},
		{method: "GET", path: "/api/category"},
	},
	build: func(base string) []pipeline.EndpointRecord {
		a := base + "/api"
		return []pipeline.EndpointRecord{
			{
				URL:    a + "/auth",
				Method: "GET",
				Notes: "Authentication: GET /api/auth with HTTP Basic credentials returns a session token. " +
					"Register/obtain a low-privilege account via the web shop first, then use its token on the " +
					"BOLA routes below.",
			},
			{
				URL:    a + "/user/me",
				Method: "GET",
				Notes: "Current user's profile (requires auth). Use it to learn your own user_id, then attack " +
					"other ids via PUT /api/user/{user_id}.",
			},
			{
				URL:         a + "/user/{{victim_user_id}}",
				Method:      "PUT",
				Interesting: true,
				Parameters:  []string{"user_id"},
				Notes: "BOLA write: update another user's account by user_id with your own token. A 200 " +
					"mutating a record you do not own proves broken object-level authorization.",
			},
			{
				URL:         a + "/cart/{{victim_cart_id}}",
				Method:      "GET",
				Interesting: true,
				Parameters:  []string{"cart_id"},
				Notes: "BOLA (flagship): read another user's cart by cart_id with your own token. Enumerate " +
					"cart_id values; a 200 returning a cart that is not yours proves the flaw. PUT/DELETE on the " +
					"same path let you modify/empty another user's cart.",
			},
			{
				URL:         a + "/cart/{{victim_cart_id}}",
				Method:      "DELETE",
				Interesting: true,
				Parameters:  []string{"cart_id"},
				Notes: "BOLA destructive: delete another user's cart by id. A 2xx on a cart you do not own " +
					"proves the flaw. Destructive — target a throwaway cart created for the test.",
			},
			{
				URL:         a + "/order/{{victim_order_id}}",
				Method:      "GET",
				Interesting: true,
				Parameters:  []string{"order_id"},
				Notes: "BOLA: read another user's order (shipping address, items, totals) by order_id with " +
					"your own token. A 200 returning someone else's order proves the finding.",
			},
			{
				URL:    a + "/product",
				Method: "GET",
				Notes: "Product listing (page, categoryID query params). The categoryID / page params and the " +
					"web shop's product search are SQL-injection candidates — point sqlmap at the injectable " +
					"parameter; the timing/differential --verify oracles can then re-prove it.",
			},
			{
				URL:        a + "/cartItems",
				Method:     "POST",
				Parameters: []string{"uid"},
				Notes: "Add item to cart (uid query param). The uid parameter selecting whose cart is modified " +
					"is a BOLA/mass-assignment candidate — supplying another user's uid may operate on their " +
					"cart.",
			},
		}
	},
	chains: nil,
}