== Try It!   DOM-Based XSS

Some attacks are 'blind'. Fortunately, you have the server running here so you will be able to tell if you are successful.
Use the route you just found and see if you can use the fact that it reflects a parameter from the route without encoding to execute an internal function in WebGoat.
The function you want to execute is ...

*webgoat.customjs.phoneHome()*

Sure, you could just use console/debug to trigger it, but you need to trigger it via a URL in a new tab.

Once you do trigger it, a subsequent response will come to the browser with a random number. Put that random number in below.
