On hamsters, Escaping, Escaping of Hamsters and the Lack of escaping in Hamster…

A SensePost blog post from 2007 demonstrates a proof-of-concept XSS weakness in ErrataSec's Hamster tool: by injecting encoded JavaScript into a cookie (gmailchat) and leveraging Hamster's parsing, an attacker can execute arbitrary script in the Hamster web console (including redirects and BeEF/backframe hooks) without user interaction; the post documents exploitation steps, encoding bypasses, and notes Hamster was a demo POC not intended for public use.