Get hijached user and pass from XSS