XSS Attacks

XSS Exploited 9 Chapter 6 223

This previous section of code is what does the trick. First, we overwrite the action of

the login form. This particular approach assumes the form has no name, otherwise we could

use the

2etElementsByName

method to locate and change the form action. Next we write the

"target user" value to the User field. Once the data is written in the field, we simulate a user

interacting with the Username field and then the Password field via the focus function.

Finally, we wait two seconds for the password to show up and then submit the user/pass- ...