⚠️ 03 — Cross-Site Scripting (XSS)
0/3 solved
🏗️ Hard — DOM-Based XSS
This page reads the URL hash fragment and inserts it into the DOM. No server interaction needed.
Waiting for hash fragment...
Add to the URL:
#<img src=x onerror=alert(1)>. The JS reads window.location.hash and sets innerHTML — a classic DOM XSS.