Targets iframe.src and iframe.srcdoc sinks used by iast_iframe_navigation. Populate the fields with tainted routes or HTML, prime sources, then trigger the buttons.
Taint is read from ?url=..., ?srcdoc=..., the hash fragment, or the inputs above when primed.