HiNet_modem_QRcode_Bypass.js

// ==UserScript==
// @name         HiNet modem QR Code Bypass
// @namespace    http://tampermonkey.net/
// @version      0.3
// @description  Bypass HiNet modem QR Code 2FA when login as Engineering mode
// @author       G36maid
// @match        http://192.168.1.1/*
// @match        https://192.168.1.1/*
// @grant        none
// @run-at       document-start
// ==/UserScript==

(function() {
    'use strict';

    const originalXHRSend = XMLHttpRequest.prototype.send;
    const originalXHROpen = XMLHttpRequest.prototype.open;

    XMLHttpRequest.prototype.open = function(method, url, async, user, password) {
        this._url = url;
        return originalXHROpen.call(this, method, url, async, user, password);
    };

    XMLHttpRequest.prototype.send = function(data) {
        if (this._url && this._url.includes('/cgi-bin/UserLoginCheck')) {
            const originalOnReadyStateChange = this.onreadystatechange;

            this.onreadystatechange = function() {
                if (this.readyState === 4 && this.status === 200) {
                    try {
                        const responseData = JSON.parse(this.responseText);
                        if (responseData && responseData.PasswordQrcode) {
                            responseData.PasswordQrcode = false;

                            Object.defineProperty(this, 'responseText', {
                                writable: true,
                                configurable: true,
                                value: JSON.stringify(responseData)
                            });

                            Object.defineProperty(this, 'response', {
                                writable: true,
                                configurable: true,
                                value: JSON.stringify(responseData)
                            });
                        }
                    } catch (e) {
                        // Ignore non-JSON responses
                    }
                }

                if (originalOnReadyStateChange) {
                    originalOnReadyStateChange.call(this);
                }
            };
        }

        return originalXHRSend.call(this, data);
    };
})();