succeeded to rewrite the elements in iframe from parent page.
deployed vulne.plain to heroku