DOM XSS – document.write Sink Using location.search Inside a select Element

This lab demonstrates a DOM-based XSS vulnerability in a stock-checker flow. User-controlled input from location.search is written into the DOM through document.write without sanitization, inside a select element.

Exploitation reasoning

The first payloads failed because option elements restrict which HTML elements and event handlers can execute. The successful approach was to reason about the current parsing context, close the option and select elements, and inject a new element outside that restricted context.

Key takeaways

• DOM XSS can occur entirely on the client side.
• Exploitation depends on the HTML context, not only on controlling input.
• document.write is dangerous when it processes unsanitized values.
• Context-breaking is often necessary before executable markup can be introduced.