This lab contains a DOM-based cross-site scripting vulnerability in the stock checker functionality.
It uses the JavaScript
document.write
function, which writes data out to the page. Thedocument.write
function is called with data fromlocation.search
which you can control using the website URL. The data is enclosed within a select element.To solve this lab, perform a cross-site scripting attack that breaks out of the select element and calls the
alert
function.

Select any element: https://0a060014049d514780bc08700015003f.web-security-academy.net/product?productId=1


This script gets the param storeId and from it, adds an option tag into the select.
https://0a060014049d514780bc08700015003f.web-security-academy.net/product?productId=1&storeId=12345


We can try to close the select tag and then add a payload.
According the documentation:
We could use a payload ad: <img src=1 onerror=alert(document.domain)>
Then:
https://0a060014049d514780bc08700015003f.web-security-academy.net/product?productId=1&storeId=12345</select><img src=1 onerror=alert(document.domain)>



