23) Exploiting cross-site scripting to capture passwords