XSSContentDiscover. This is a PoC for an attack path I've seen on multiple engagements I wanted to standardize.