3 · Credential-reuse — Site A MEDIUM

Step 1 (here): enter a password (e.g. P@ssw0rd123) and submit → no detection yet (first use).
Step 2: open Site B on a different host and submit the same password → fires. Only a salted hash ever leaves the page.

Submitted on Site A. Now open Site B → http://127.0.0.1:4005/phishing/credential-reuse-b.html and submit the same password.