TBDXSS

Visit And Tigger The Payload

opennote.php

Domain Victim

open

submit.php

Logger.php

Nav3

redirect

Now content of /note changed

Nav2

opener

main.php

Nav1

Domain Hacker

Delay 1000ms to wait change successful

/change_note

GetFlagdocument.opener.openr.document.body.textContent

/note(Payload)

TBDXSS

Ajax Send Flag

index.php

/note:(Flag)

CSRF Payload