JS does document.write(location.search). Try /dom/write?x=<img src=x onerror=alert(document.domain)>
document.write(location.search)
/dom/write?x=<img src=x onerror=alert(document.domain)>
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only