[bnchdrff]

This will take forever, and also make the user's browser unresponsive.

for(var c=0;i<255;i++) { for (var d=0;j<255;j++) { document.write('<iframe height="1" width="1" src="http://192.168. + c + '.' + d + '" id="' + i + '.' + j + '" name="' + c + '.' + d + '"></iframe>'); } }

<iframe> portscans, wow.

For a massively-deployed hack like Samy's, it makes plenty of sense to just check the small handful of major-brand wifi routers.

[woodall]

I totally agree. You should only be checking for routers that have known vulnerabilities, but was not the initial question.