whoisinsecure.js

function recurseIframes(doc, iframes) {
	let newIframes = doc.querySelectorAll('iframe');
	if (newIframes.length > 0) {
		iframes.push.apply(iframes, newIframes);
		newIframes.forEach(iframe => {
			recurseIframes(iframe, iframes);
		})
	}
	return iframes;
}
recurseIframes(document, []).forEach(iframe => {
	let formElements = document.querySelectorAll("[type='submit'], form, input, textarea");
	if (formElements.length > 0) {
		console.log(`iFrame with form elements has src ${iframe.src}`);
		console.log('form elements are:', formElements);
		let owner = iframe;
		while (owner = owner.ownerDocument) {
			console.log(`ownerDocument src: ${iframe.ownerDocument.src}`);
		}
	}
})