I'm learning DOM XSS and I have this code :

     Select your language:
        document.write("<OPTION value=1>"+document.location.href.substring(document.location.href.indexOf("default=")+8)+"</OPTION>");
        document.write("<OPTION value=2>English</OPTION>");

but I don't understand why this payload doesn't trigger any XSS :

t.html?default=test</option><img src=x onerror=alert(1)/>

It looks like the symbols are encoded and I don't understand why...

I took the script from https://www.owasp.org/index.php/DOM_Based_XSS so I guess it's vulnerable but I don't know how to exploit it...


It doesn't work because the payload is URL-encoded.

If you navigate to


you will see the literal characters <>" in your URL bar, but the browser has actually requested


. That is, your browser always URL-encodes some characters in the query string, including quotes and angle brackets.

So, if you access location.href via JS, the payload in your example will be returned as


. This does not produce any HTML tags unless you URL-decode it first.

Note: As far as I know, all modern browsers now behave that way, but historically, some implementations have implicitly URL-decoded values for the location interface. In these browsers, your attack would have worked.

  • Oh I see... Ok ! Thank you so much ! So this webpage is not vulnerable anymore ?
    – Neolex
    Mar 25 '19 at 5:53
  • 2
    There may still be browsers that let you sneak literal quotes and angle brackets somewhere in the URL where they don't get URL-encoded. But I believe your example isn't vulnerable in modern Chrome and Firefox.
    – Arminius
    Mar 25 '19 at 5:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.