I am using Lua with the HTTP library and I am creating a script that will test for XSS This is the payload i'm using
<image/src/onerror=prompt(8)>
Now the script will do an HTTP request to the website and adding the payload after the query like this ip/?query=<image/src/onerror=prompt(8)>
How can I tell if the prompt was successful and the payload is working?
Are there any hints in the source code or the HTTP request so i can now that the site is vulnerable to XSS?
No.
Just doing a request and retrieving the resulting HTML source won't have executed the JavaScript (client-side) prompt(8) invocation.
You would need to use a browser to see if the code gets executed; in your case, probably a scriptable browser runner such as Playwright or Puppeteer.