> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/es/web/xss/dom-xss-document-write-with-location-search.md).

# XSS DOM document.write con location.search

### XSS DOM en document.write mediante la fuente location.search

Este laboratorio contiene una vulnerabilidad de DOM del lado XSS en la función de seguimiento de la consulta de búsqueda. La página usa `document.write` para escribir datos de `location.search` en el DOM, que puede controlarse mediante la URL.

**Descripción de la vulnerabilidad**/ `document.write` se llama con la `location.search` cadena sin saneamiento. Como la entrada proviene directamente de la URL, un atacante puede inyectar HTML/JS en la página manipulando `location.search`.

<figure><img src="/files/874a9f2909d0bfc83f874c06897810db8aa4a191" alt=""><figcaption></figcaption></figure>

**Objetivo de la resolución** Realiza un ataque XSS del lado del DOM que invoque la `alert()` función cuando se cargue la página.

**Comentarios/índices**/ El código genera algo como un `<img>` etiqueta que contiene un `searchTerms` parámetro entre comillas, por ejemplo:

```html
<img src="/resources/images/tracker.gif?searchTerms=Jordan">
```

<figure><img src="/files/5116f6fe3b47a7247ed07fa998515494b30a0606" alt=""><figcaption></figcaption></figure>

Si cierras la `<img>` etiqueta y las comillas, puedes insertar contenido HTML/JS arbitrario.

**Ejemplos de cargas útiles probadas (proporcionadas)**/ Cierra la etiqueta e inyecta HTML:

```html
"><h1>hack</h1>
```

<figure><img src="/files/4cdc2f11c74ff4c6c462e21947e4bf630ba409f8" alt=""><figcaption></figcaption></figure>

Cierra la etiqueta e inyecta un script para activar `alerta`:

```javascript
"><script>alert("xss")</script>
```

<figure><img src="/files/3f2e6ed7a14f726745708525e7f7d49668a65c2b" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/es/web/xss/dom-xss-document-write-with-location-search.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.