test.py

test.py

from flask import Flask, request, jsonify

app = Flask(__name__)

@app.route("/cookie-test", methods=["GET", "POST"])
def cookie_test():
    found = []

    # 1. Normal HTTP cookies (Cookie header parsed by Flask)
    if request.cookies:
        found.append({
            "source": "request.cookies (parsed Cookie header)",
            "value": dict(request.cookies)
        })

    # 2. Raw Cookie header
    raw_cookie = request.headers.get("Cookie")
    if raw_cookie:
        found.append({
            "source": "Raw Cookie header",
            "value": raw_cookie
        })

    # 3. Query parameters (?cookie=...)
    if request.args:
        found.append({
            "source": "Query parameters",
            "value": request.args.to_dict()
        })

    # 4. POST body (text / JSON / form)
    if request.data:
        found.append({
            "source": "Raw request body",
            "value": request.data.decode(errors="ignore")
        })

    if request.form:
        found.append({
            "source": "Form data",
            "value": request.form.to_dict()
        })

    if request.is_json:
        found.append({
            "source": "JSON body",
            "value": request.get_json()
        })

    # 5. Custom headers
    for h in request.headers:
        if "cookie" in h[0].lower() and h[0].lower() != "cookie":
            found.append({
                "source": f"Custom header: {h[0]}",
                "value": h[1]
            })

    if not found:
        return jsonify({
            "status": "NO COOKIE FOUND",
            "reason": "Browser did not send cookies, and no manual exfiltration detected"
        })

    return jsonify({
        "status": "COOKIE FOUND",
        "results": found
    })


if __name__ == "__main__":
    app.run(debug=True)