XSS are executed on the client-side. You can use javascript, DOM to steal data, cookie, deface....
I tried many times with javascript, but i found beef, XSS framework. One work: include script and send malicous code to victim:
If XSS in POST request, you can create page, it will generate POST request:

MF: http://www.mediafire.com/?832ps4haqqg3989
------------------------------------------------------------
Thanks for reading
--------------------------------------------------------------------------
All my Lab:
Linux Lab -- window and Cisco Lab
to be continued - I will update more.

Nam Habach