XSS
Medium · DOM XSS

The Hash in the URL

HackerMart's search is a single-page app: the results route is driven by the URL hash — `#/search?q=<your text>`. The page never sends your input to the server at all. JavaScript reads the hash and writes it into the page. The server is innocent; the browser-side code is the problem. Try it in the address bar.

Objective

Fire an alert box by crafting a URL hash — without touching the server.

Target

HackerMart

Launch target

Submit flag