HTML injection to another user's site?

Question

I have a product that integrates into websites in the same way as Paypal (customers add my button to their website, users click on this button, and as soon as the service is completed, I redirect them back to the original website).

I would like to demonstrate my technologies to customers without changing their own website. For this purpose, can I configure http://stackoverflow.myserver.com/ to reflect http://www.stackoverflow.com/ by smoothly entering my button?

Meaning, I want to demonstrate the experience of using my button on a website without actually re-hosting the client database on my server.

I know that there are security issues here, so feel free to mention them as long as we meet the requirements. I do not need to show this on a website using HTTPS.

More specifically . I would like to demonstrate the idea of ​​financial bounties on Stackoverflow issues by entering the Paypal button on the page. How can I remove this from http://stackoverflow.myserver.com/ without changing /qaru.site / ... ?

REQUEST TO COMPLETE . I reformulated the question, which will be more specific at your request. If you still think that it is too wide, please help me understand your reasoning by posting a comment below.

UPDATE . I posted the following task in How to rewrite URLs referenced by Javascript code?

UPDATE2 . I rejected the idea of ​​bookmarklets and Greasemonkey, because they require installation / modification on the client side. We need to make the process as smooth as possible, otherwise many of them will be disabled by the process and will not allow us to step.

Answer 1

After playing with this for a very long time, I ended up doing the following:

• Rewrite HTML and JS files on the fly. All other resources are hosted on the original website.
• For HTML files, insert the <base> to indicate the website is redirected. This will force the browser to automatically redirect relative links (to an HTML file, CSS files, and even Flash!) To the original website.
• For JS files, use a regular expression to fix certain sections of code that point to a written URL. I load the redirected page in the browser, look for broken links and find out which JS section needs to be fixed in order to fix the problem.

It sounds a lot harder than it really is. On average, fixing each page takes less than 5 minutes of work.

The big discovery was the <base> ! He fixed the vast majority of links on my behalf.

Answer 2

I would suggest creating a proxy using an HTTP handler .

In ProcessRequest you can do an HttpWebRequest to get the content on the other hand, change it and return the adjusted html to the browser. You can rewrite URLs internally to allow images to be uploaded, etc. From the source.

 public void ProcessRequest(HttpContext context) { // get the content using HttpWebRequest string html = ... // alter it // write back the adjusted html context.Response.Write(html); } 

Answer 3

If you are demonstrating on the client side and want to hack it quickly, you can remove it using some jQuery. I pressed the button after the SO logo just for demonstration. You can enter it in the console:

 $('head').append('<script src="https://www.paypalobjects.com/js/external/dg.js" type="text/javascript"></script>') $('#hlogo').append('<form action="https://www.sandbox.paypal.com/webapps/adaptivepayment/flow/pay" target="PPDGFrame" class="standard"><label for="buy">Buy Now:</label><input type="image" id="submitBtn" value="Pay with PayPal" src="https://www.paypalobjects.com/en_US/i/btn/btn_paynowCC_LG.gif"><input id="type" type="hidden" name="expType" value="light"><input id="paykey" type="hidden" name="paykey" value="insert_pay_key">') var embeddedPPFlow = new PAYPAL.apps.DGFlow({trigger: 'submitBtn'}); 

Now I'm not sure if I did something wrong or not, because I got this error in the last part:

 Expected 'none' or URL but found 'alpha('. Error in parsing value for 'filter'. Declaration dropped. 

But, in any case, if you are a demo, you could just do it, perhaps like plan B. (You can also write a custom pointer for this, so you don't need to open the console, I think?)