> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/dom-based-xss/lab-2.md).

# Lab 2

<figure><img src="/files/cQPQLXSAOVWCNeMEnJLp" alt=""><figcaption></figcaption></figure>

```
https://0a1e00ec0407e90580cf2689005c004b.web-security-academy.net/?search=%3Cimg%20src=1%20onerror=alert(1)%3E
```

We see it gets the search parameter&#x20;

#### Source = where attacker data enters the JavaScript

A **source** is anywhere your JS code reads data that *the attacker can control*.

<figure><img src="/files/mb66Gs8JAYQjBRoA8xA9" alt=""><figcaption></figcaption></figure>

#### Sink = where JavaScript does something dangerous with that data

A **sink** is a JS function or property that *interprets a string as something more than text* — typically HTML, JavaScript code, or a URL that gets navigated to.

<figure><img src="/files/Npxq9r6rhfTD8XFZnCPt" alt=""><figcaption></figcaption></figure>