// for script: try { onmessage = e => eval(e.data) } catch {} try { alert('xss') } catch {} try { (parent!=window)&&parent.alert('parent.xss') } catch {} // for iframe: