4 ms·

What's the trivial solution to this? I also wound up hosting the malicious file on my personal server...

• deleted 12y ago
  [deleted]
• trias 12y ago
  data-uris also work: #data:text/javascript,alert('pwn')
  • aidos 12y ago
    That's what I used too. Hosting scripts is far too much like hard work...
• hrrsn 12y ago
  There are apparently easier ways, but I just chucked an alert(); in my Dropbox public folder, did an //dl.dropboxusercontent.com/u/14XXX/xss.js as they serve both http and https.
• deleted 12y ago
  [deleted]
• joshschreuder 12y ago
  I put a small gist up and hotlinked through githack.com
• deleted 12y ago
  [deleted]