== Try It!   DOM-Based XSS

Some attacks are 'blind'. Fortunately, you have the server running here so you will be able to tell if you are successful. Use the route you just found and see if
you can use the fact that it reflects a parameter from the route without encoding to execute an internal function in WebGoat. The function you want to execute is ...

*webgoat.customjs.phoneHome()*

Sure, you could just use console/debug to trigger it, but you need to trigger it via a URL in a new tab.  Once you complete it, paste the output message from the log below ...

