DOM-BASED XSS

CLIENT-SIDE · innerHTML SINK

Unsafe sink: URL hash written to innerHTML without sanitization. Payload in fragment executes in victim browser — no server reflection needed.

[ OUTPUT SINK ]

Welcome message rendered from URL hash:

Try payload in hash:

[*] Page loads hash into innerHTML on init...

Fix: Use textContent, DOMPurify, avoid innerHTML with user input. CSP script-src blocks inline handlers.