Authorization disclaimer. This walkthrough is limited to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test only systems you own or are explicitly authorized to assess.

Overview

The search page writes location.search into a tracker image string: client JavaScript creates a tracker image from location.search; "><svg onload=alert(1)> breaks the attribute/tag context and creates an executable SVG handler. The quote and tag terminator escape that generated attribute before the SVG handler is parsed.

Lab objective/setup

Exercise DOM XSS in document.write sink using source location.search through the endpoint and input recorded in the lab note. Client JavaScript creates a tracker image from location.search; "><svg onload=alert(1)> breaks the attribute/tag context and creates an executable SVG handler.

What I observed

client JavaScript creates a tracker image from location.search; "><svg onload=alert(1)> breaks the attribute/tag context and creates an executable SVG handler.

The search page script reads location.search and interpolates it into the src attribute of a tracker image passed to document.write.
The search page script reads location.search and interpolates it into the src attribute of a tracker image passed to document.write.
The inert payload string `"><svg onload=alert(1)>` closes the tracker img attribute and tag before introducing an SVG onload handler.
The inert payload string `"><svg onload=alert(1)>` closes the tracker img attribute and tag before introducing an SVG onload handler.

Why it is vulnerable

Client JavaScript creates a tracker image from location.search; "><svg onload=alert(1)> breaks the attribute/tag context and creates an executable SVG handler. The application passes that value into the security-sensitive operation without the context-specific validation or encoding needed to prevent this result.

Walkthrough in the authorized PortSwigger lab

Inspect the client script to locate the tracker img construction, submit the quote-closing SVG payload as the search term, and verify in the DOM that the tracker markup ends before a new SVG element whose onload calls alert(1).

The submitted search URL contains the encoded quote-closing SVG payload consumed by the document.write tracker sink.
The submitted search URL contains the encoded quote-closing SVG payload consumed by the document.write tracker sink.
Browser developer tools show the generated tracker img followed by the injected svg element whose onload handler calls alert(1).
Browser developer tools show the generated tracker img followed by the injected svg element whose onload handler calls alert(1).

Verification

The lab is confirmed when client JavaScript creates a tracker image from location.search; "><svg onload=alert(1)> breaks the attribute/tag context and creates an executable SVG handler. The captured result and the Academy solved state provide the verification; an ordinary status code alone does not.

Impact and defensive lesson

String-built HTML turns query text into executable markup. Remove document.write; create the image through DOM APIs and assign attacker-influenced data only to validated properties.

References