== Try It!   DOM-Based XSS

Some attacks are "blind." Fortunately, you have the server running here, so you can tell if you are successful.
Use the route you just found and see if you can use it to reflect a parameter from the route without encoding to execute an internal function in WebGoat.
The function you want to execute is:

*webgoat.customjs.phoneHome()*

Sure, you could use console/debug to trigger it, but you need to trigger it via a URL in a new tab.

Once you trigger it, a subsequent response will come to your browser's console with a random number. Put that random number below.
