[RogueCoder]

Another way to do this is if you find a field vulnerable to XSS. Look into document.documentElement.innerHTML. One thing to remember is that this only affects the page that loads the content you've injected