D2 eval(hash)

JS runs eval(location.hash). The hash never reaches the server. Try /dom/eval#alert(document.domain)

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only