Lab: DOM XSS in document.write sink using source location.search
Summary: This PortSwigger lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality, where the JavaScript document.write function is called with data from location.search that the user controls through the website URL. Solving the lab requires performing a cross-site scripting attack that calls the alert function, breaking out of the img attribute via the search input.
What you should know: The flaw is a client-side sink fed directly by a URL parameter, so the payload never has to reach the server to execute in a victim's browser - which is exactly the class of input that server-side filtering and request inspection do not see.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026