Webinar – Popping Shells Instead of Alert Boxes: Weaponizing XSS for Fun and Profit