phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes ·...

13
phishing-20170904-lille3_zohopublic-1-mail.txt ==================== MAIL ======================= De: Université Lille 3 <[email protected]> Objet: Université Lille 3 mise à jour par courriel Date: 4 septembre 2017 à 13:13:48 UTC+2 À: [email protected] Cher utilisateur E-mail, Nous sommes actuellement en train de mettre à niveau notre système de messagerie pour une meilleure performance. Pour mettre à niveau votre compte et garder votre compte actif. CLIQUEZ ICI: Si vous ne respectez pas ce message, votre compte sera bloqué temporairement. Cordialement, Equipe de soutien informatique, Université de Lille 3. Service d'authentification Lille 3. ================================================= Page 1

Transcript of phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes ·...

Page 1: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-1-mail.txt==================== MAIL =======================De: Université Lille 3 <[email protected]>Objet: Université Lille 3 mise à jour par courrielDate: 4 septembre 2017 à 13:13:48 UTC+2À: [email protected]

Cher utilisateur E-mail,

Nous sommes actuellement en train de mettre à niveau notre système de messageriepour une meilleure performance.

Pour mettre à niveau votre compte et garder votre compte actif.

CLIQUEZ ICI:

Si vous ne respectez pas ce message, votre compte sera bloqué temporairement. Cordialement,Equipe de soutien informatique,Université de Lille 3.Service d'authentification Lille 3.=================================================

Page 1

Page 2: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3
Page 3: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt================== SOURCE DE LA PAGE WEB ====================================<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml"><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=0"/><meta name="MobileOptimized" content="width"><meta name="HandheldFriendly" content="true"><meta name="apple-mobile-web-app-capable"content="yes"><meta http-equiv="cleartype" content="on"><meta name="apple-itunes-app" content="app-id=805565969, app-argument=myURL"><meta property="og:title" content="Universit&eacute;&#x20;de&#x20;Lille&#x20;3" /><meta property="og:type" content="website" /><meta property="og:url" content="https://forms.zohopublic.com/univlille3fr/form/UniversitdeLille3/formperma/Ff1ghBk1Cef5105H2gA4059a5" /><meta property="og:description" content="Service&#x20;d&#x27;authentification&#x20;Lille&#x20;3" /><title>Zoho Forms</title><head><link href="https://img.zohostatic.com/forms/Sep_04_2017/images/favicon.ico" rel="shortcut icon">

<link rel="stylesheet" href="https://css.zohostatic.com/forms/Sep_04_2017/css/formsthirdparty.css"><link rel="stylesheet" href="https://css.zohostatic.com/forms/Sep_04_2017/css/formslive.css"><link href='/formstatic/fonts?family=Open+Sans:400,700i,700,600i,600,400i,300i,300' rel='stylesheet' type='text/css'>

</head><link href="/formstatic/css/themes/flower.css" rel="stylesheet" type="text/css"

/><style id="CUSTOM_STYLE_TAG"></style>

<link href="/formstatic/css/themes/media.css" rel="stylesheet" type="text/css"/><link href="/formstatic/css/themes/media/flowerMedia.css" rel="stylesheet" type="text/css"/><script>var i18n = {"entervalue":"Enter\x20a\x20value\x20for\x20this\x20field.","entervalidmail":"Enter\x20a\x20valid\x20email\x20address.","entervalidnumber":"Enter\x20a\x20valid\x20number.","invaliddecimal":"Enter\x20a\x20valid\x20decimal\x20number.","invalidcurrency":"Enter\x20valid\x20currency.","invalidurl":"Enter\x20a\x20valid\x20website.","invalidphone":"Enter\x20a\x20valid\x20phone\x20number.","selectchoice":"Select\x20any\x20choice\x20for\x20this\x20field.","chooseoption":"Choose\x20any\x20option\x28s\x29\x20for\x20this\x20field.","selectdate":"Select\x20a\x20date\x20for\x20this\x20field.","selectrating":"Specify\x20your\x20rating.","selecttime":"Select\x20any\x20time\x20for\x20this\x20field.","checkfield":"Check\x20this\x20field.",

Page 1

Page 4: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt"choosefile":"Choose\x20any\x20file\x20for\x20this\x20field.","contactadmin":"Please\x20contact\x20your\x20form\x20administrator\x20for\x20further\x20assistance.","incompletesignature":"The\x20signature\x20seems\x20to\x20be\x20incomplete.","matrixchoicemandatory":"Choose\x20at\x20least\x20one\x20option\x20from\x20each\x20row.","chooseval":"Choose\x20a\x20value\x20for\x20this\x20field","select":"\x2DSelect\x2D","wrongverificationcode":"Enter\x20the\x20correct\x20verification\x20code.","incompleteinputtime":"Invalid\x20entry.\x20Enter\x20time\x20in\x20proper\x20format\x20\x28HH\x3AMM\x20AM\x2FPM\x29.","fileupload":"There\x20was\x20an\x20error\x20while\x20uploading\x20file.\x20Please\x20try\x20again.","formclosed":"The\x20Form\x20your\x20are\x20trying\x20to\x20access\x20is\x20closed.","donationhintmsg":"Min.\x20amount\x20is","paymentdecimallen":"Maximum\x20decimal\x20length\x20is\x20\x7B0\x7D\x20digits.","entervalidamount":"Enter\x20a\x20valid\x20amount.","moredecimalplaces":"Decimal\x20places\x20exceed\x20the\x20maximum\x20decimal\x20length.", "emailsnotmatched":"EEmail address does not seem to match.", "formPaymentError":"Data added successfully! For some reason the Payment hasn&apos;t gone through. Please contact admin to resolve the problem.", "invalidentriesfound":"Invalid entries found.", "correctentries":"Please check your entries and try again.", "erroroccurred":"Error Occurred!", "unabletoconnecttosheetserver":"Unable to connect to Zoho Sheet server.", "internalserver":"Error occurred. Please write to us at [email protected]", "paymenttransaction":"Transaction failed.", "errorinformsubmission":"Error occurred while submitting Form." };</script><head>

<script type="text/javascript" src="https://js.zohostatic.com/forms/Sep_04_2017/js/formsthirdpartylivejs.js"></script><script type="text/javascript" src="https://js.zohostatic.com/forms/Sep_04_2017/js/formscommonlive.js"></script><script type="text/javascript" src="https://js.zohostatic.com/forms/Sep_04_2017/js/formslive.js"></script>

</head>

<input type="hidden" name="antispam-url" value="https://as.zoho.com/cf/checkurl.cf?URL=" id="antispam-url-id" /><!--<script type="text/javascript" src="/js/redirecturl.js"></script>--><!-- Disable antispam redirection temporarily. -->

<body class="backgroundBg"><div class="backgroundSecBg"><div elname="frmTemplate" class="templateWidth"><div class="topContainer"></div><div class="centerContainer "><div id="formDiv">

Page 2

Page 5: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt<div id="logo-wallpaper" class="fLogowall" style="display:none"><img id="logo-wallpaper-img" src=""/></div><div id="fileuploadtemplate" style="display:none" ></div><form name="test" id="test"><input type="hidden" name="formName" value="UniversitdeLille3" id="formName"/><!-- Form Perma will be sent only for PermaUrls --><input type="hidden" name="formPerma" value="Ff1ghBk1Cef5105H2gA4059a5" id="formPerma"/><input type="hidden" name="referrerName" id="referrerName" value="null"/><input type="hidden" name="isPaymentForm" value="false" id="isPaymentForm"/><input type="hidden" name="formType" value="0" id="formType"/><input type="hidden" id="zf_date_format" name="date_format" value="dd-MMM-yyyy" id="formType"/><input type="hidden" name="isDocsPublicForm" value="false" id="isDocsPublicForm"/><input type="hidden" name="formrid" value="null" id="formrid"/><div class="templateWrapper" id="formRedirectURL">

<ul class="tempHeadBdr formRelative"><li class="tempHeadContBdr"><span id="logo-formheader" class="formLogo" style="display: none"><img id="logo-formheader-img" src="" /></span> <h2 class="frmTitle">Universit&eacute; de Lille 3</h2><p class="frmDesc">Service d&#x27;authentification Lille 3</p><div class="clearBoth"></div></li></ul>

<!-- 'FieldElement' class is imported in order to get the key for display name of the component of 'Address' field. -->

<div id="formBodyDiv" class="formRelative subContWrap topAlign">

<ul elname="formBodyULName" class="ulNoStyle" page_no="1" >

<!-- i) Private form, ii) Perma, iii) Shared form, iv) Theme preview, v) CurrentTheme --><!-- "isVisible"="false": This 'Admin Only' field must not be shown to user. --><!-- "isVisible"="true": Case 1: This is not an 'Admin Only' field. Case 2: This'Admin Only' field must be shown to user. --><!-- Theme Preview, Current Theme - Admin Only fields will be shown. Formula

won't be calculated. Field Rules won't be executed. -->

<li class="tempFrmWrapper small" elname="livefield-elem" comptype="1" id="SingleLine-li" needdata="true" compname="SingleLine" isvisible=true

mandatory="false"><label class="labelName">Nom d&#x27;utilisateur&#x3a;

</label><div class="tempContDiv"><span><input type="text" maxlength="255" name="SingleLine" value=""/></span>

<p class="errorMessage" elname="error" id="error-SingleLine"></p></div><div class="clearBoth"></div></li>

Page 3

Page 6: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt<li class="tempFrmWrapper small" elname="livefield-elem" comptype="1" id="SingleLine1-li" needdata="true" compname="SingleLine1" isvisible=true

mandatory="false"><label class="labelName">Adresse e-mail&#x3a;

</label><div class="tempContDiv"><span><input type="text" maxlength="255" name="SingleLine1" value=""/></span>

<p class="errorMessage" elname="error" id="error-SingleLine1"></p></div><div class="clearBoth"></div></li>

<li class="tempFrmWrapper small" elname="livefield-elem" comptype="1" id="SingleLine2-li" needdata="true" compname="SingleLine2" isvisible=true

mandatory="false"><label class="labelName">Mot de passe&#x3a;

</label><div class="tempContDiv"><span><input type="text" maxlength="255" name="SingleLine2" value=""/></span>

<p class="errorMessage" elname="error" id="error-SingleLine2"></p></div><div class="clearBoth"></div></li>

<li class="tempFrmWrapper small" elname="livefield-elem" comptype="1" id="SingleLine3-li" needdata="true" compname="SingleLine3" isvisible=true

mandatory="false"><label class="labelName">Confirmez le mot de passe&#x3a;

</label><div class="tempContDiv"><span><input type="text" maxlength="255" name="SingleLine3" value=""/></span>

<p class="errorMessage" elname="error" id="error-SingleLine3"></p></div><div class="clearBoth"></div></li>

</ul></div>

<ul elname="footer" class="footerWrapper formRelative" page_no="1" page_count="1" ><li style="overflow:visible; position: relative;" class=

"btnAllign fmFooter"

id="formAccess" elname="0">

<div class="pageFotDef">

<div class="alignSubmit">

Page 4

Page 7: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt<div class="formRelative inlineBlock submitWrapper"><button class="fmSmtButton submitColor" elname="submit" value="submit"><em>Submit</em></button></div></div>

</div><div class="clearBoth"></div></li></ul><div id="popupdiv" class="dim-div2" style="display:none;"><div id="imageChoiceDiv-cont" class="popUpOuter imageTypeZoom" ><div class="popUpInnerWrapper"><div class="popupHeader removeBdr"><a class="flRight ppDeleteIcon" onclick="ZFLive.hideZoomedImage();" href="javascript:;"></a><div class="clearBoth"></div></div><div class="popupMainCont"><img src=""></div></div></div></div><!-- Uncomment the following Code to enable automation location based value filling for GeoLocation Fields --><!-- Set the mapquestURL from zohoforms.properties --><!-- -->

<!--Div to show error for unconfirmed users --><div id="errorDiv" style="display:none" class="errorMsgWrapper"><div class="flLeft errorIcon"></div><div class="errorMsgCont"><h2>Error Occurred!</h2><span id="errorMsgSpan">You haven&apos;t verified your email yet, click<a href="javascript:;" onclick="ZFUtil.resendMail('0');"> here </a> to receive a verification email.</span></div><div class="clearBoth"></div></div><div class="brandingContainer"><div class="flRight rContainer"><span>Powered by</span> <a href="https://www.zoho.com/forms?utm_source=thankyoupage&utm_medium=banner&utm_campaign=successfulresponse" target="_blank"><img src="https://img.zohostatic.com/forms/Sep_04_2017/images/smallLogo.png" align="absbottom" /></a><p>Zoho does not endorse collection of confidential information.</p></div><div class=" clearBoth"></div></div></div><!-- 'formRedirectURL' ends --></form></div><!-- 'formDiv' ends --></div><!-- 'centerContainer' ends --><div class="btmContainer"></div></div><!-- 'templateWidth' ends --><div class="clearBoth"></div></div><!-- 'backgroundSecBg' ends --><div id="paymentDummyDiv" style="display:none;"></div><!--<div id="successDiv" class="zf-loading blackLoad" style="position: absolute;top: 112px; left: 568.5px;display:none;" elname="edit-form-msg"><span>IAMEncoder.encodeHTML(successMessage)</span><img src="/images/loader.gif"></div><div id="waitDiv" class="zf-loading blackLoad" style="position: absolute; top: 112px; left: 568.5px;display:none;" elname="edit-form-msg"><span>IAMEncoder.encodeHTML(successMessage)</span><img src="/images/loader.gif"></div>--> <!-- DIV TO SHOW ERROR MESSAGE WHEN THE FORM SUBMISSION LEVEL REACHED --> <div class="dim-div" style="display:none;" id="settingsErr-div"><div class="popUpOuter" style="width: 370px; position: absolute; top: 131px; left: 489.5px;" id="settingsErr-div-cont"><div class="popUpInner"><div class="popupHeader removeBdr"><a href="javascript:;" onclick="closeErrorPopup();" class="flRight ppDeleteIcon"></a><div class="clearBoth"></div></div><div class="popupMainCont"><div class="popUpFields"><label id="popHeader"></label><div id="msgBody"></div></div></div><div class="popupTemFot" style="text-align:

Page 5

Page 8: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txtcenter"><a href="javascript:;" onclick="closeErrorPopup();" class="btnCurve lightGray">OK</a></div></div></div></div><div style="display:none;" class="dim-div" id="errmsg-div"><div class="popUpOuter" id="errmsgdivCont" style="width:500px;"><div class="popUpInner"><div class="popupHeader removeBdr"><a class="flRight ppDeleteIcon" onclick="closeErrMsgPopUp()"></a><div class="clearBoth"></div></div><div class="popupMainCont messageCont"><p elname="errorMsg">Enter the correct verification code.</p></div></div></div></div><div style="display:none;" class="dim-div" id="form-deactive-div"><div class="deactivatedMsg" id="formdeactivedivCont"><divclass="popUpInner"><div class="errMsg"><span>Your form has been deactivated.</span> <span>Contact [email protected] for further information.</span></div></div></div></div><div id="pleaseWait_Div" style="display: none;" class="dim-div1"><div id="pleaseWait_DivCont" class="popUpOuter loaderWrapper"><div class="popUpInner"><div class="loaderCont"><img src="https://img.zohostatic.com/forms/Sep_04_2017/images/loader.gif" /><span>Submitting...</span></div></div></div></div><div id="savingDiv" style="display: none;" class="dim-div1"><div id="savingDivCont" class="popUpOuter loaderWrapper"><div class="popUpInner"><div class="loaderCont"><img src="https://img.zohostatic.com/forms/Sep_04_2017/images/loader.gif" /><span>Saving...</span></div></div></div></div><div id="paymentRedirectDiv" style="display: none;" class="dim-div1"><div id="paymentRedirectDivCont" class="popUpOuter loaderWrapper"><div class="popUpInner"><div class="loaderCont"><img src="https://img.zohostatic.com/forms/Sep_04_2017/images/loader.gif" /><span>Redirecting to Merchant Website..</span></div></div></div></div><div id="paymentProcessingDiv" style="display: none;" class="dim-div1"><div id="paymentProcessingDivCont" class="popUpOuter loaderWrapper"><div class="popUpInner"><div class="loaderCont"><img src="https://img.zohostatic.com/forms/Sep_04_2017/images/loader.gif" /><span>Verifying Credit Card Details...</span></div></div></div></div><!--Email verification info div --> <div id="infoMsgDiv" class="loadingCont loadSuccess" style="display:none;"><em class="smallTickIcon"></em><span id="info-msg">Verification mail sent.</span></div><div id="saveUrlPopup" style="display:none;"><div class="dim-div darkDim" ></div><div class="popUpOuterSave" ><div class="popUpInner"><div class="popupHeader"><a href="javascript:;" onclick="ZFLive.closePopUp('savePopUpDiv'); event.stopPropagation();" class="flRight ppDeleteIcon"></a></div><div class="popupMainCont"><p> Save this link to resume later.</p><textarea onclick="selectTxtAreaCont(this);" readonly> </textarea></div></div></div></div><script>$(document).ready(function(){

// Sometimes "User-Agent" won't be present in the Request header.

var userAgent = "Mozilla\x2F5.0\x20\x28Windows\x20NT\x2010.0\x3B\x20rv\x3A55.0\x29\x20Gecko\x2F20100101\x20Firefox\x2F55.0";if(userAgent.indexOf("Mobile")!=-1){if(window.top.location != window.self.location){$("#deviceCont").hide();}

Page 6

Page 9: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt}

ZFLive.portalName = "univlille3fr";ZFLive.formLinkName = "UniversitdeLille3";ZFLive.csrf = '7ee4bd01-be0c-4855-8e2b-1a213e340f81';ZFLive.accountsUrl = "https://accounts.zoho.com";ZFLive.isEditMode = "false";// request type is 1 for response editZFLive.recID = "";ZFLive.encodedString = "";ZFLive.skipValidation = falseZFLive.isSaveReq = false;ZFLive.saveRecord = "false";ZFLive.paymentMerchantList = null;

ZFLive.mode = "live"; //Code for formula fieldZFLive.formulaJson = null;

ZFLive.formulaJson = '\x5B\x5D';

ZFLive.formulaFieldsList = null;

ZFLive.formulaFieldsList = '\x5B\x5D';ZFLive.bindEventForFormula("live");

if(ZFLive.formulaJson != null){ ZFLive.evalExpressionOnFormLoad("live");

}// ZFLive.formPermaUrl = "Ff1ghBk1Cef5105H2gA4059a5";// For Forms in custom theme, there is no need to set the height.var winHt = $(window).height();var divHt = $("#formRedirectURL").height();//No I18N$("#formRedirectURL").attr("style","min-height:"+(winHt -130)+"px;");//No I18N

// Focussing of first field must not be done, if the form is embedded in some other site.if(window.top.location === window.self.location) {// Date/Date-Time picker must not be opened when they're present as first field.var liToBeFocussed = $("#formBodyDiv").find("li[comptype]:visible:first"); // Excluding Section & Description.var compType = parseInt($(liToBeFocussed).attr("comptype")); // No I18Nif(isNaN(compType)){var compName = $(liToBeFocussed).attr("compname"); // No I18Nif(compName == "PaymentAmount" && $(liToBeFocussed).find("input:enabled").length!= 0){$(liToBeFocussed).find("input:enabled:first").focus();}}else if(compType != ZFFieldTypeConstants.DATE && compType != ZFFieldTypeConstants.DATETIME){if($(liToBeFocussed).find("input").length != 0){ // For SL, Number, Decimal, Email, Phone Number, Website, Currency, Radio, Checkbox, D.box, FU, Name, Address, Geolocation.

Page 7

Page 10: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt$(liToBeFocussed).find("input:first").focus();}else if(compType === ZFFieldTypeConstants.TIME || compType === ZFFieldTypeConstants.DROPDOWN|| compType === ZFFieldTypeConstants.MULTIPLE_CHOICE){ // For Time, Dropdown, Multiple Choice.$(liToBeFocussed).find("select:first").focus();}else if(compType === ZFFieldTypeConstants.MULTI_LINE){ // For MultiLine$(liToBeFocussed).find("textarea").focus();}else if(compType === ZFFieldTypeConstants.RATING || compType === ZFFieldTypeConstants.SLIDER){$(liToBeFocussed).find("a:first").focus();}// Focussing 'Signature' field is ignored.}

}var fieldsCount = 0;$("#test").find('ul[elname=formBodyULName]').find("li").each(function(index,elem){var compname = $(elem).attr("compname");var id = $(elem).attr("id");var compType = $(elem).attr("comptype");if(compType == 19){var fileData = [];ZFLive.fileUploadFields[compname] = fileData;}if(compname != null ){fieldsCount = fieldsCount + 1;}});if(fieldsCount == 0){$('form[name=test]').find('button[elname=submit]').hide();$('form[name=test]').find('button[elname=save]').hide();}var descLiElem = $("#formBodyDiv").find("li[compname=HtmlText]");$(descLiElem).find(":button").attr("disabled",true); // No I18N$('form[name=test]').find('input, select').keypress(function(e){if ( e.which == 13 ) // Enter key = keycode 13{// preventDefault action is done so that submit action for form is not getting called automatically.e.preventDefault();var pageCount = $("#formBodyDiv").find('ul[elname=formBodyULName]').length;var pageNum = $(this).closest('ul[elname=formBodyULName]').attr('page_no'); // No I18Nif(pageCount != pageNum){$("#formRedirectURL").find('ul[elname=footer][page_no='+pageNum+']').find('button[elname=next]').click();

Page 8

Page 11: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txtfocusFirstField($("#formBodyDiv").find('ul[elname=formBodyULName][page_no='+(parseInt(pageNum)+1)+']'));}else{

// Form submit action through enter key press is blocked while submission process is taking place.if($('button[elname="submit"]').attr("disabled") !== "disabled"){$('form[name=test]').find("button[elname=submit]").click();}

}}}); $('form[name=test]').find("button[elname=submit]").click(function(e) { e.preventDefault();$("#fileuploadtemplate").html("<form style=\"display:none\" id=\"ZF-UploadFileForm\" target=\"zc-fileupload-target\" enctype=\"multipart/form-data\" method=\"post\" name=\"UploadFileForm\" action=\"/univlille3fr/form/UniversitdeLille3/uploadFile\"><input type=\"hidden\" name=\"mode\" value=\"live\"/><input type=\"hidden\" name=\"zfcpn\"/></form><iframe style=\"display:none;\" width=\"1%\" scrolling=\"no\" height=\"30\" frameborder=\"0\" align=\"top\" marginheight=\"0\" marginwidth=\"0\" name=\"zc-fileupload-target\"><html><head></head><body></body></html></iframe>");$("#ZF-UploadFileForm").attr("action","/univlille3fr/form/UniversitdeLille3/formperma/Ff1ghBk1Cef5105H2gA4059a5/uploadFile"); var merchantType = $("#test").find("div[elname=merchantDiv]").attr("merchantType"); // No I18Nif(merchantType != null && merchantType == 3){// if stripe payment field is not hidden via field rulesif($('#PaymentAmount-li').attr('needdata') === 'true'){ Stripe.setPublishableKey('');var stripeResponseHandler = function(status, response) {var $form = $('#test');// No I18Nvar paymentLI = $("#formBodyDiv").find('.pmnt');// No I18Nvar merchantDiv = $(paymentLI).find("div[elname=stripeMerchantDiv]");if (response.error) {// Show the errors on the form$("#paymentProcessingDiv").hide();// No I18N

$('button[elname="submit"]').removeAttr('disabled'); // No I18N//$form.find('.payment-errors').text(response.error.message);$(merchantDiv).addClass("error1");// No I18N$("#payment-error").show();$("#payment-error").text(response.error.message);var pageNum = paymentLI.parent().attr('page_no');// No I18NshowAndHidePage(pageNum);focusFirstErrorElem(paymentLI);} else {$(merchantDiv).removeClass("error1");// No I18N$("#payment-error").hide();// token contains id, last4, and card type

Page 9

Page 12: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txt$("#paymentProcessingDiv").hide();// No I18Nvar token = response.id;// Insert the token into the form so it gets submitted to the server//$("#formBodyDiv").append($('<li needdata="true" id="stripeToken-li" compname="stripeToken" mandatory="true"><input type="hidden" name="stripeToken"

/></li>')); //No I18N$("#test").find("ul[elname=formBodyULName]").last().append($('<li needdata="true" id="stripeToken-li" compname="stripeToken"

mandatory="true"><input type="hidden" name="stripeToken" /></li>')); //No I18N

$("input[name='stripeToken']").val(token); //No I18N// and re-submitZFLive.ValidateAndSubmitData();

$('button[elname="submit"]').removeAttr('disabled'); // No I18N}};$("#paymentProcessingDiv").show();// No I18NsetPopUpElemPosition($("#paymentProcessingDivCont"));// No I18N

$('button[elname="submit"]').attr('disabled', 'disabled'); // No I18N Stripe.createToken($("#test"), stripeResponseHandler); //No I18N

} else { // if stripe payment field is hidden via field rules ZFLive.ValidateAndSubmitData();

}} else {ZFLive.ValidateAndSubmitData();}});$('form[name=test]').find("button[elname=update]").click(function(e) { e.preventDefault();$("#fileuploadtemplate").html("<form style=\"display:none\" id=\"ZF-UploadFileForm\" target=\"zc-fileupload-target\" enctype=\"multipart/form-data\" method=\"post\" name=\"UploadFileForm\" action=\"/univlille3fr/form/UniversitdeLille3/record/null/uploadFile\"><input type=\"hidden\" name=\"mode\" value=\"edit\"/><input type=\"hidden\" name=\"zfcpn\"/></form><iframe style=\"display:none;\" width=\"1%\" scrolling=\"no\" height=\"30\" frameborder=\"0\" align=\"top\" marginheight=\"0\" marginwidth=\"0\" name=\"zc-fileupload-target\"><html><head></head><body></body></html></iframe>");$("#ZF-UploadFileForm").attr("action","/univlille3fr/form/UniversitdeLille3/formperma/Ff1ghBk1Cef5105H2gA4059a5/uploadFile");

ZFLive.ValidateAndUpdateData("univlille3fr","UniversitdeLille3"); });$('form[name=test]').find("button[elname=save]").click(function(e) { e.preventDefault();$("#fileuploadtemplate").html("<form style=\"display:none\" id=\"ZF-UploadFileForm\" target=\"zc-fileupload-target\" enctype=\"multipart/form-data\" method=\"post\" name=\"UploadFileForm\" action=\"/univlille3fr/form/UniversitdeLille3/uploadFile\"><input type=\"hidden\" name=\"mode\" value=\"live\"/><input type=\"hidden\" name=\"zfcpn\"/></form><iframe style=\"display:none;\" width=\"1%\" scrolling=\"no\" height=\"30\" frameborder=\"0\" align=\"top\"

Page 10

Page 13: phishing-20170904-lille3 zohopublic-1-mail.txt - Bloc-notes · phishing-20170904-lille3_zohopublic-1-mail.txt ===== MAIL ===== De: Université Lille 3

phishing-20170904-lille3_zohopublic-3-source_page.txtmarginheight=\"0\" marginwidth=\"0\" name=\"zc-fileupload-target\"><html><head></head><body></body></html></iframe>");$("#ZF-UploadFileForm").attr("action","/univlille3fr/form/UniversitdeLille3/formperma/Ff1ghBk1Cef5105H2gA4059a5/uploadFile");

ZFLive.ValidateAndSaveData(); });

// checkAlign(); });// Field rules var zf_rule = new ZFRule();

zf_rule.getFormRules('/univlille3fr/form/UniversitdeLille3/formperma/Ff1ghBk1Cef5105H2gA4059a5/rules/fieldrules',ZFUtil.getCSRF("zfccn"));</script></body></html>==============================================================================

Page 11