04 - DOM XSS in innerHTML sink using source location.search
To solve this lab, perform a cross-site scripting attack that calls the alert function.
Given - XSS in search blog, type(DOM)
End goal - call alert function
As usual , start the lab and search for any keyword. I searched 'cs' -
Now this time our keyword is getting inside into another tag.
Script tag is not allowed. So another payload can be - <svg onload="alert(4)"></svg>
Lab solved :
