demo.html

﻿<!DOCTYPE html>
<html>
<head>
	<meta charset="utf-8">
	<meta http-equiv="x-ua-compatible" content="ie=edge">
	<title>demo</title>
	<meta name="description" content="">
</head>
<body>

	<div class="flex-child">
		<a href="#" class="ui-idx-link">
			<div class="">查看面板console</div>
		</a>
	</div>
		
	<script src="xss.js"></script>
	<script>
	window.addEventListener("load", function() {
		xss(function() {
			console.log('可疑行为：', arguments);
		});

		// var a = document.createElement("script");a.src="baidu.com"
		
		// document.getElementsByTagName("script")[0].setAttribute("src","baidu.com")
		
		// document.getElementsByTagName("script")[0].src="http://haha.js"
		
		// var a = document.createElement("script");a.setAttribute("src","xss2.js");document.body.appendChild(a);
		
		// var a = document.createElement("script");a.innerHTML="alert();";document.body.appendChild(a);
	});
	</script>
</body>
</html>