Primer paso de la investigacion. Se aportan el .apk, las carpetas con el apk extraido y el apk descompilado. El archivo API_DOCUMENTATION.md es un archivo donde se anotaran los descubrimientos del funcionamiento de la API, y los .py son scripts para probar la funcionalidad de la API con los métodos que vayamos encontrando. Finalmente, los archivos .js son scripts de Frida para extraer informacion de la APP durante la ejecucion.
This commit is contained in:
175
api_testing_scripts/test_api_authenticated.py
Normal file
175
api_testing_scripts/test_api_authenticated.py
Normal file
@@ -0,0 +1,175 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Test de endpoints de Adif con autenticación HMAC-SHA256
|
||||
"""
|
||||
|
||||
import requests
|
||||
import json
|
||||
from adif_auth import AdifAuthenticator
|
||||
|
||||
# Claves extraídas con Frida
|
||||
ACCESS_KEY = "and20210615"
|
||||
SECRET_KEY = "Jthjtr946RTt"
|
||||
USER_ID = "0c8c32dce47f8512"
|
||||
|
||||
# Crear autenticador
|
||||
auth = AdifAuthenticator(ACCESS_KEY, SECRET_KEY, USER_ID)
|
||||
|
||||
def test_departures():
|
||||
"""Probar endpoint de salidas"""
|
||||
print("\n" + "="*70)
|
||||
print("TEST: Salidas de Madrid Atocha (Cercanías)")
|
||||
print("="*70)
|
||||
|
||||
host = "circulacion.api.adif.es"
|
||||
path = "/portroyalmanager/secure/circulationpaths/departures/traffictype/"
|
||||
url = f"https://{host}{path}"
|
||||
|
||||
payload = {
|
||||
"stationCode": "10200",
|
||||
"commercialService": "BOTH",
|
||||
"commercialStopType": "BOTH",
|
||||
"page": {"pageNumber": 0},
|
||||
"trafficType": "CERCANIAS"
|
||||
}
|
||||
|
||||
payload_str = json.dumps(payload)
|
||||
|
||||
# Firmar petición
|
||||
headers = auth.sign_request(
|
||||
method="POST",
|
||||
host=host,
|
||||
path=path,
|
||||
payload=payload_str
|
||||
)
|
||||
|
||||
print(f"\nURL: {url}")
|
||||
print(f"Payload: {payload_str}")
|
||||
print(f"\nHeaders:")
|
||||
for k, v in headers.items():
|
||||
if k == "Authorization":
|
||||
print(f" {k}: {v[:50]}...")
|
||||
else:
|
||||
print(f" {k}: {v}")
|
||||
|
||||
# Hacer petición
|
||||
try:
|
||||
response = requests.post(url, headers=headers, data=payload_str, timeout=10)
|
||||
print(f"\nStatus Code: {response.status_code}")
|
||||
|
||||
if response.status_code == 200:
|
||||
print("✅ SUCCESS!")
|
||||
data = response.json()
|
||||
print(f"\nRespuesta (preview):")
|
||||
print(json.dumps(data, indent=2, ensure_ascii=False)[:1000])
|
||||
else:
|
||||
print(f"❌ ERROR")
|
||||
print(f"Response: {response.text[:500]}")
|
||||
|
||||
except Exception as e:
|
||||
print(f"❌ EXCEPTION: {e}")
|
||||
|
||||
|
||||
def test_station_details():
|
||||
"""Probar endpoint de detalles de estación"""
|
||||
print("\n" + "="*70)
|
||||
print("TEST: Detalles de estación Madrid Atocha")
|
||||
print("="*70)
|
||||
|
||||
host = "estaciones.api.adif.es"
|
||||
path = "/portroyalmanager/secure/stations/onestation/"
|
||||
url = f"https://{host}{path}"
|
||||
|
||||
payload = {"stationCode": "10200"}
|
||||
payload_str = json.dumps(payload)
|
||||
|
||||
headers = auth.sign_request(
|
||||
method="POST",
|
||||
host=host,
|
||||
path=path,
|
||||
payload=payload_str
|
||||
)
|
||||
|
||||
print(f"\nURL: {url}")
|
||||
print(f"Payload: {payload_str}")
|
||||
|
||||
try:
|
||||
response = requests.post(url, headers=headers, data=payload_str, timeout=10)
|
||||
print(f"\nStatus Code: {response.status_code}")
|
||||
|
||||
if response.status_code == 200:
|
||||
print("✅ SUCCESS!")
|
||||
data = response.json()
|
||||
print(f"\nRespuesta (preview):")
|
||||
print(json.dumps(data, indent=2, ensure_ascii=False)[:1000])
|
||||
else:
|
||||
print(f"❌ ERROR")
|
||||
print(f"Response: {response.text[:500]}")
|
||||
|
||||
except Exception as e:
|
||||
print(f"❌ EXCEPTION: {e}")
|
||||
|
||||
|
||||
def test_arrivals():
|
||||
"""Probar endpoint de llegadas"""
|
||||
print("\n" + "="*70)
|
||||
print("TEST: Llegadas a Madrid Atocha (Todos los tipos)")
|
||||
print("="*70)
|
||||
|
||||
host = "circulacion.api.adif.es"
|
||||
path = "/portroyalmanager/secure/circulationpaths/arrivals/traffictype/"
|
||||
url = f"https://{host}{path}"
|
||||
|
||||
payload = {
|
||||
"stationCode": "10200",
|
||||
"commercialService": "BOTH",
|
||||
"commercialStopType": "BOTH",
|
||||
"page": {"pageNumber": 0},
|
||||
"trafficType": "ALL"
|
||||
}
|
||||
|
||||
payload_str = json.dumps(payload)
|
||||
|
||||
headers = auth.sign_request(
|
||||
method="POST",
|
||||
host=host,
|
||||
path=path,
|
||||
payload=payload_str
|
||||
)
|
||||
|
||||
print(f"\nURL: {url}")
|
||||
|
||||
try:
|
||||
response = requests.post(url, headers=headers, data=payload_str, timeout=10)
|
||||
print(f"\nStatus Code: {response.status_code}")
|
||||
|
||||
if response.status_code == 200:
|
||||
print("✅ SUCCESS!")
|
||||
data = response.json()
|
||||
print(f"\nRespuesta (preview):")
|
||||
print(json.dumps(data, indent=2, ensure_ascii=False)[:800])
|
||||
else:
|
||||
print(f"❌ ERROR")
|
||||
print(f"Response: {response.text[:500]}")
|
||||
|
||||
except Exception as e:
|
||||
print(f"❌ EXCEPTION: {e}")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
print("\n" + "="*70)
|
||||
print("PRUEBAS DE API ADIF CON AUTENTICACIÓN HMAC-SHA256")
|
||||
print("="*70)
|
||||
print(f"\nUsando claves:")
|
||||
print(f" ACCESS_KEY: {ACCESS_KEY}")
|
||||
print(f" SECRET_KEY: {SECRET_KEY}")
|
||||
print(f" USER_ID: {USER_ID}")
|
||||
|
||||
# Ejecutar tests
|
||||
test_departures()
|
||||
test_station_details()
|
||||
test_arrivals()
|
||||
|
||||
print("\n" + "="*70)
|
||||
print("TESTS COMPLETADOS")
|
||||
print("="*70)
|
||||
Reference in New Issue
Block a user