carlosvillasanchez

<div id="html" class="text">
    <h1 class="light">
    </h1>
</div>

<div id="intigriti">
    <div id="last">
        <script>
            <div class="a">
            (...)

carlosvillasanchez

<div id="html" class="text">
    <h1 class="light">
    </h1>
</div>

<div id="intigriti">
    <div class="a">'"</div>

    <div id="container">
        <span>I</span>

carlosvillasanchez

<div id="html" class="text">
    <h1 class="light">
    
        INPUT
<div class="a">'"</div>

<div id="container">
    <span>I</span>
    <span>I</span>
</div>

carlosvillasanchez

window.addEventListener("DOMContentLoaded", function () {
    jsCode = `)]}'` + new URL(location.href).searchParams.get("xss");
    lastElementOfBody = document.getElementById("body").lastElementChild;
    if (lastElementOfBody.id === "intigriti") {
        lastElementOfIntigriti = lastElementOfBody.lastElementChild;
        htmlOfLastElementOfIntigriti = lastElementOfIntigriti.innerHTML.trim();
        jsPrefix = htmlOfLastElementOfIntigriti.substr(htmlOfLastElementOfIntigriti.length - 4);
        jsCode = jsPrefix + jsCode;
    }
    let scriptTag = document.createElement("script");

carlosvillasanchez

window.addEventListener("DOMContentLoaded", function () {
    e = `)]}'` + new URL(location.href).searchParams.get("xss");
    c = document.getElementById("body").lastElementChild;
    if (c.id === "intigriti") {
        l = c.lastElementChild;
        i = l.innerHTML.trim();
        f = i.substr(i.length - 4);
        e = f + e;
    }
    let s = document.createElement("script");

carlosvillasanchez

alert(1)