I'm trying an XSS challenge. I found an exploit that breaks CSP by using a JSONP callback. I can get an alert to pop up by putting something like:
But I'm having trouble trying to get it to send an HTTP-request. I've tried putting functions changing
window.location, but it doesn't seem to execute any of my anon functions.