Sidenote: does anyone know why all these cancer scripts use this approach of using an initial Javascript payload to create a `script` tag, instead of just being a `script` tag directly?
Less round trips. Less bandwidth.
For more reading look here:http://dev.housetrip.com/2014/04/17/unleash-your-ajax-reques...
But in general here's what is wanted.
- No OPTIONS request
- Third party domain.
- withCredentials - pass cookies in the request.
The best option in this case is actually a injected async script element.
Source: worked in ad tech a few years ago. Looked into all the possible options, this came up least bad, and explained why it was so popular.
This was really common before CORS.
I thought dynamically injected script elements were async by default?
https://developer.mozilla.org/en-US/docs/Web/API/HTMLScriptE...
Yes, I learned it not so long ago in fact and I am a bit ashamed of it.
Try to save this into a HTML file:
<html>
<body>
<script>
let someJSON = {"hello": "</script><script>alert('powned')</script>"}
</script>
This the because the browser has a HTML parsing phase, and only after JS is executed.
When <script> is parsed, then the HTML parser is looking for the next </script>. It doesn't matter if the </script> happened to be inside the context of a JavaScript string. At this point the browser doesn't know about JS.