Want everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.
Sure enough, when he drops the URL in his browser, the injected JavaScript is executed and the browser redirects to his malicious site.