Added explanation

dschadow · dschadow · commit 2d4d705125a0 · 2016-03-06T16:46:19.000+01:00
diff --git a/xss/src/main/webapp/index.jsp b/xss/src/main/webapp/index.jsp
@@ -8,6 +8,8 @@
 <body>
 	<h1>Cross-Site Scripting (XSS)</h1>
 
+    <p>Use &lt;script&gt;alert(document.cookie)&lt;/script&gt; as input to simulate a Cross-Site Scripting attack.</p>
+
     <form action="unprotected" id="unprotectedForm" method="post">
         <fieldset>
             <legend>Unprotected</legend>
