クロスサイトスクリプティング DOM postMessage - yujitounai/helloworld GitHub Wiki

<div class="box">postMessageのXSS<br>
<form method="get" action="">search
<input name="word" type="text">
<input type="submit">
</form>
<span id="ads">
SECRET data is here
</span>
<script>
window.addEventListener('message', function(e) {
       document.getElementById('ads').innerHTML = e.data;
})
</script>
</div>