> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-document-write-with-location-search.md).
# location.search 中的 DOM document.write XSS
### 使用源 location.search 的 document.write 中的 DOM XSS
该实验在搜索查询跟踪功能中包含一个 XSS 侧的 DOM 漏洞。该页面使用 `document.write` 将来自……的数据写入 `location.search` 到 DOM 中，这可以通过 URL 进行控制。
**漏洞描述**/ `document.write` 会以……调用 `location.search` 未经净化的字符串。由于输入直接来自 URL，攻击者可以通过操纵……向页面注入 HTML/JS `location.search`.
**解决目标** 执行一次 DOM 侧的 XSS 攻击，以调用 `alert()` 函数，当页面加载时。
**注释/提示**/ 代码会生成类似一个 `` 标签，其中包含一个 `searchTerms` 带引号的参数，例如：
```html
```
如果你闭合该 `` 标签和引号，你就可以插入任意 HTML/JS 内容。
**已测试载荷示例（已提供）**/ 闭合标签并注入 HTML：
```html
">
hack
```
闭合标签并注入脚本以触发 `alert`:
```javascript
">
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-document-write-with-location-search.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
```