control hundreds / thousands of browsers though XSS. similar to BeEF.  JavaScript with small PHP/Python api.