http://lewanzu.com/2016/11/30/hctf2016-xss/index.htm