title: How to perform a simple DOM-based XSS attack
body: <p>Here's my index.html (vulnerable):</p>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;html&gt;
  
    &lt;head&gt;
      &lt;link rel="stylesheet" href="style.css"&gt;
      &lt;script src="script.js"&gt;&lt;/script&gt;
    &lt;/head&gt;
  &lt;script&gt;
      document.write("&lt;form&gt;&lt;select&gt;"); 
  
      document.write("&lt;option value=1&gt;" + 
      document.location.href.substring(document.location.href.indexOf("default=") + 8)
  + "&lt;/option&gt;");
  
      document.write("&lt;option value=2&gt; French &lt;/option&gt;");
  
      document.write("&lt;/select&gt; &lt;/form&gt;");
      document.write(document.location.href);
  &lt;/script&gt;
    &lt;body&gt;
  
    &lt;/body&gt;
  
  &lt;/html&gt;
  </code></pre>
  
  <p>It supposed to get default language from <code>../index.html?default=English</code> which will set the default language into English.</p>
  
  <p>I'm trying to use <code>../index.html?default=&lt;script&gt;alert(document.cookie)&lt;/script&gt;</code> to show the cookie on the screen, but the browser seems to encode <code>&gt;</code> into <code>%3E</code>. I have also used <code>\x3Cscript&gt;alert(document.cookie)\x3C/script&gt;</code>, <code>\x3Cscript\3Ealert(document.cookie)\x3C/script\3E and &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;</code>, but no luck.</p>