title: Testing for XSS vulnerabilities when URl contains hidden fields
body: <p>i am checking for XSS vulnerabilities for my portal. the examples that i found on internet says that, if you have a URl like this </p>
  
  <pre><code>http://www.yoursite.com/index.html?name=george
  </code></pre>
  
  <p>try encoding it like </p>
  
  <pre><code>http://www.yoursite.com/index.html?name=&lt;script&gt;alert('You just found a XSS vulnerability')&lt;/script&gt;
  </code></pre>
  
  <p>and if you find alert , it will show that your portal is XSS vulnerable.
  but my question is my url doesn't contains any variable , as i am using hidden fields
  my url looks like </p>
  
  <pre><code>http://[myip]:8080/appshop-V1/appStoreRegistration.html
  </code></pre>
  
  <p>and it doesn't changes on any post or get operation .how can i insert script in such scenario and check for vulnerabilities. </p>