You don't need to inject scripts to make this sort of thing work. Just add img or style tags with the source set to the target you want to attack. The browser w

You don't need to inject scripts to make this sort of thing work. Just add img or style tags with the source set to the target you want to attack. The browser will happily go try to fetch the files from the server, adding to the request load. You can see unintentional examples of this happening. Small sites get taken down occasionally when larger sites directly link to images or videos hosted there.