[adraenwan]

maybe OP tried it's exploit in internet explorer 5.0, but I doubt it'll work in any recent (read: less than 5 years old) browser.

[thedaly]

See for yourself fam

https://wordlewebsite.com/sqword

[masklinn]

Modern browsers will straight up tell the server the resource is being loaded from an iframe via Sec-Fetch-Dest.

[henriquez]

Oh it works. Just Google sqword if you don’t believe.