I can embed an iframe in a website, but I can't point it to anything along the lines of "javascript:alert(1)". Is there a page I can build that can run javascript in the context of the parent document? SOP prevents me from directly accessing things like parent.document. Any ideas?

There isn't much you can do in this situation. You can redirect the page, and if the parent uses X-Frame-Options: SAMEORIGIN then you bypass that and launch UI-redressing attacks; see http://www.skeletonscribe.net/2012/06/x-frame-options-sameorigin-warning.html

-------------------------------------------------------
Research blog