WAF bypass XSS by senthenes

@senthenes has unlocked a ? smorgasbord of a bug chain! ?postMessage, ?JSONP, ?WAF bypass, ?DOM-based XSS, ?CORS, ?CSRF… ?What’s next? ?https://t.co/oBZif7Zyms