> For the complete documentation index, see [llms.txt](https://books.spartan-cybersec.com/web/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://books.spartan-cybersec.com/web/prototype-pollution/lab-3-dom-xss-via-an-alternative-prototype-pollution-vector/utilizando-dom-invader.md).

# Utilizando DOM Invader

Accedemos al devtools con el DOM Invader ya instalado y configurado.

Y analizamos lo siguiente:

<figure><img src="https://1990863415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCohdns2VDWfowigRKoD0%2Fuploads%2FMHQvKhZezljHz8wrsuhQ%2Fimage.png?alt=media&amp;token=b2418d9e-3584-4afb-a390-f13a4245b048" alt=""><figcaption></figcaption></figure>

Luego de clickear en "scan for gadgets" nos retorna el siguiente mensaje:

<figure><img src="https://1990863415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCohdns2VDWfowigRKoD0%2Fuploads%2FqtJNOkBoYAmuMAVh8x54%2Fimage.png?alt=media&amp;token=786ee6c2-21de-4ae7-b2bf-441611aa2659" alt=""><figcaption></figcaption></figure>

Al clickear en "exploit" no funciona debido a la explicacion que se proporciono en la explotacion manual.

Por lo anterior, se procede agregar el caracter "-":

```
?__proto__.sequence=alert%281%29-
```

<figure><img src="https://1990863415-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCohdns2VDWfowigRKoD0%2Fuploads%2F30jtbKZMHYxl5xCPwCXY%2Fimage.png?alt=media&amp;token=4e399ed4-780b-4d3d-bb28-09c3fc14a60a" alt=""><figcaption></figcaption></figure>