Anonymous User
<h2>Wow, this site has a nasty XSS vulnerability!</h2>
<input type='button' value='Click me for a laugh!' onclick='changePersonality()'/>
<h2>I wonder if I can see your cookie with this script?</h2>
<input type='button' value='Click to see your cookie!' onclick='alert(document.cookie)'/>
<h2>Hey, would you post your cookie to my website please?</h2>
<input type='button' value='Click to POST your cookie!' onclick='alert("Just kidding, but keep in mind that a real attacker would not ask before doing this!")'/>
<script>
function changePersonality() {
  var image = document.images[0]
  if (image.src.match('google')) {
    // switch back to Fabrikam
    image.src = 'art/Fabrikam.gif';
  }
  else {
	// switch to Google
	image.src = 'http://www.google.com/intl/en/images/logo.gif';
  }
}
</script>