mission · xss-dom-hash
The Hash in the URL
HackerMart's search is a single-page app: the results route is driven by the URL hash — `#/search?q=<your text>`. The page never sends your input to the server at all. JavaScript reads the hash and writes it into the page. The server is innocent; the browser-side code is the problem. Try it in the address bar.
objective
Fire an alert box by crafting a URL hash — without touching the server.
Simulated target for training. This page is the vulnerable website — payloads you craft execute here in your browser. Practice only on systems you own or are authorized to test.