-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathapp.py
60 lines (50 loc) · 1.62 KB
/
app.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
from flask import Flask,request
from markupsafe import escape
app = Flask(__name__)
@app.route("/",methods=["GET","POST"])
def xxs_playground():
if request.method == "GET":
return page_view()
elif request.method == "POST":
return render_unsafe(request.form["payload"],request.form["context"])
view_templ = """
<html>
<head>
<title> XSS playground </title>
</head>
<body>
<p> Try payload here </p>
<form action="/" method=POST>
<textarea name="payload" row="10" cols=60>payload</textarea>
<br>
<textarea name="context" row="10" cols=60>context</textarea>
<input type=submit value=submit>
</form>
</html>
"""
result_templ = """
<html>
<head>
<title> XSS playground </title>
</head>
<body>
<p> Try payload here </p>
<form action="/" method=POST>
<textarea name="payload" row="10" cols=60>{epayload}</textarea>
<br>
<textarea name="context" row="10" cols=60>{econtext}</textarea>
<input type=submit value=submit>
</form>
<p>Result: </p>
<p> {eresult} </p>
<br>
{contexed_payload}
</html>
"""
def page_view():
return view_templ
def render_unsafe(payload,context):
return result_templ.format(epayload=escape(payload),
eresult=escape(context.format(payload)),
econtext=escape(context),
contexed_payload=context.format(payload))