A form can send it's HTTP request anywhere. So a form on
someone else's page can send a request to our app. If that page
is running on our browser, it will have our session cookie attached.
If a hacker can fill in a form on our page, and get the user to
submit it, it sends an apparently legitimate HTTP request to our
server. This gets worse when forms are auto-filled from the command
line. Try reloading this page with:
server162.site:[port]/flaw.html?name=dumpMySessionKey
This applies to text boxes as well. Pasting data
from a textbox into the page using innerHTML could cause your
page to run arbitrary code.
Try typing <img src=x onerror="alert('XSS Attack')">
in the textbox below (make sure the angle brackets are real).