This lab contains a DOM-based cross-site scripting vulnerability in the search query tracking functionality. It uses the JavaScript document.write function, which writes data out to the page. The document.write function is called with data from location.search, which you can control using the website URL.

To solve this lab, perform a cross-site scripting attack that calls the alert function.

If we check the source code, we can see:

<script>
	function trackSearch(query) {
	    document.write('<img src="/resources/images/tracker.gif?searchTerms='+query+'">');
    }
    var query = (new URLSearchParams(window.location.search)).get('search');
	    if(query) {
	        trackSearch(query);
        }
</script>

as document.write() is who writes the query as part of an img tag we can try to close the tag and insert an alert script.

Let’s try then: "><script>alert(document.domain)</script>

As we can see we’ve broken the tag, inserted out alert tag and solved the lab.

burpSuiteAcademy