I recently found an exploit in my router to basically give me root access. The catch? There is a nonce hidden form value that is randomly generated and must be sent in for it to work that makes it difficult to do "easily"

So basically I'm wanting to do something like this in javascript:

1. get http://192.168.1.254/blah
2. use a regex or similar to extract the nonce value
3. put the nonce value into a hidden field in the current page
4. submit the form by POST to http://192.168.1.254/blah complete with the nonce value and other form values I want to send in.

Is this at all possible using only HTML and Javascript? I'm open to things like "must save HTML file locally and then open", which I'm thinking is one way around the cross domain policy.

But anyway, is this at all possible? I'm hoping for this to be able to run from at least Firefox and Chrome. The audience for this is those with some technical know how.