> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-document-write-with-location-search.md).
# 使用 location.search 的 XSS DOM document.write
使用 location.search 的 XSS DOM document.write 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 使用源 location.search 的 document.write 接收点中的 DOM XSS
此实验在搜索查询跟踪功能中包含一个 XSS 型 DOM 漏洞。该页面使用 `document.write` 来写入来自 `location.search` 到 DOM 中，这些内容可通过 URL 控制。
**漏洞描述**/ `document.write` 会以 `location.search` 未经过清理的字符串调用。由于输入直接来自 URL，攻击者可以通过操纵 `location.search`.
**解决目标** 执行一次 DOM 端的 XSS 攻击，使其调用 `alert()` 函数，在页面加载时触发。
**注释/提示**/ 代码会生成类似于一个 `` 的标签，其中包含一个 `searchTerms` 用引号括起来的参数，例如：
```html
```
如果你闭合该 `` 标签和引号，就可以插入任意 HTML/JS 内容。
**已测试的有效载荷示例（已提供）**/ 闭合标签并注入 HTML：
```html
">
hack
```
闭合标签并注入脚本以触发 `alert`:
```javascript
">
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/xss/dom-xss-document-write-with-location-search.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
```
