# 10) DOM XSS in document.write sink using source location.search inside a select element

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FnhXPVFUeQ3Qoi6ZlCEML%2Fimage.png?alt=media&#x26;token=f7dae18b-760e-4856-a8c3-f7811f28c765" alt=""><figcaption></figcaption></figure></div>

#### Locate possible injection points

As usual the first step is to analyse the application, let's open the debugger in the stock checker page and locate scripts

and we have an interesting script that takes the urlSearchParam from the url using window.location sink and write it to the DOM using document.write

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F7vWGFl2N4lJH9YqwU2gY%2Fimage.png?alt=media&#x26;token=037c7811-fbbe-4431-b3e6-ef7e2b6ee2a1" alt=""><figcaption></figcaption></figure></div>

this is the html code when the stockerId urlSearchParam is not defined yet

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FyDDfRnX3eKdhl8Ee0B1V%2Fimage.png?alt=media&#x26;token=5d2ef69f-baef-4492-bba2-1694a044c003" alt=""><figcaption></figcaption></figure></div>

if we add in the urlSearchParam storeId=test

```
https://0a30000803cd3ef685eb0b790083001d.web-security-academy.net/product?productId=4&storeId=test
```

the html code will be like this

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F9R0zeVTO6Xj6Pqtd2w55%2Fimage.png?alt=media&#x26;token=ef404fd2-0265-4a09-9d96-06d57a397af0" alt=""><figcaption></figcaption></figure></div>

so now that we know the injection point we need to get out of the option and select tags by enclosing them respectively and then add the xss payload that will trigger the alert

```
https://0a30000803cd3ef685eb0b790083001d.web-security-academy.net/product?productId=4&storeId=</option></select><img src=x onerror=alert(1)>
```

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FZHwSHfsfCvo2ssqCDvrP%2Fimage.png?alt=media&#x26;token=12a61ff4-42cb-4adf-8c92-0938167ea318" alt=""><figcaption></figcaption></figure></div>

and we have solved the lab

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2F8UkOXmG0KnYK3rNofW24%2Fimage.png?alt=media&#x26;token=5d232d4b-cdf1-422a-be2c-b65d4847295a" alt=""><figcaption></figcaption></figure></div>
