JS reads localStorage.nick into innerHTML. Seed it with /dom/storage?set=<img src=x onerror=alert(document.domain)> then reload /dom/storage.
localStorage.nick
innerHTML
/dom/storage?set=<img src=x onerror=alert(document.domain)>
/dom/storage
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only