<script>document.body.innerHTML='<div>hacked</div>';</script>