L5 DOM XSS

The name comes from the URL fragment. The server never sees it - try /dom#<img src=x onerror=alert(document.domain)>

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only