> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/dom-based-xss/lab-4.md).

# Lab 4

<figure><img src="/files/gRvr86p9OvBw8gk22K06" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/S2A1wEVKewNSbi95APrs" alt=""><figcaption></figcaption></figure>

We see that it correctly parses it through JSON.parse. However, we have a source to control - the window\.location.search.&#x20;

One thing I want to look at is the escapeHTML function.&#x20;

* It defines the function, and takes in a string named html&#x20;
* It looks for the "<" and  the ">" and replaces it with the HTML entity

This seems fine, however if we search up the html.replace function&#x20;

<figure><img src="/files/7uYPewnWV5hmZh09Y9Mh" alt=""><figcaption></figcaption></figure>

We see that it only replaces the first instance instead of all instances. We just need to add a simple <> in the beginning to take that instance.

{% hint style="info" %}
If `&lt;` and `<` mean the same thing to the browser, why is one safe and the other dangerous?<br>

#### The Two Modes: "Code Mode" vs. "Text Mode"

When a browser loads a web page, it reads the file from top to bottom.

1. Code Mode (Parsing HTML): When the browser sees a raw `<`, it says, *"Aha! A new HTML tag is starting!"* It stops rendering text and immediately prepares to execute code (like `<div>` or `<script>`).
2. Text Mode (Displaying Data): When the browser sees `&lt;`, it says, *"Oh, the developer wants me to literally display a less-than sign on the screen for the human to read."* It prints `<` to the screen, but it never treats it as code.
   {% endhint %}

<figure><img src="/files/HgOuZwXj8Piyh0UvQfAv" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/McvsmCEWK2KNLWHZZsa2" alt=""><figcaption></figcaption></figure>