DOM XSS in jQuery anchor href attribute sink using location.search source

https://siunam321.github.io/ctf/portswigger-labs/Cross-Site-Scripting/xss-5/

This lab contains a DOM-based cross-site scripting vulnerability in the submit feedback page. It uses the jQuery library's $ selector function to find an anchor element, and changes its href attribute using data from location.search.

To solve this lab, make the "back" link alert document.cookie.

---

dentro de la ruta de feedback

<script>
$(function() { 
$('#backLink').attr("href", (new URLSearchParams(window.location.search)).get('returnPath')); }); </script>

• attr() : funcion de jquery que permite manipular el dom
• utiliaz el $ como selector para encontrar un elemento anchor #backLink
• cambia su atributo href por el valor del parametro returnPath de la url

URL+?returnPath=javascript:alert(document.cookie)

Esto modifica el returnPath la "ruta de regreso" vendira a ser manejada por el boton "Back" que al presioanrlo desencadena el DOM XSS