Upload seperate payload file

Updated some payload.
XSS does not work properly because browser security is good.

However, for an example of iframe, src was successful but onload got
removed by browser, test still end up fail when it should pass based on
src alone.