script.html: pwned!