← All Challenges
Challenge 45 of 66
DOM Manipulator
🟠 Hard
Injection
+100 XP
The page reads from location.hash and inserts it into the DOM via innerHTML. Craft a URL fragment that executes JavaScript.
DOM XSS happens entirely client-side. Use an img tag with onerror in the URL hash.
🏆 Challenge Complete!
Know someone who would enjoy this? Challenge them.
Keep going
Make it count.
Join free to earn XP for what you read and solve, keep a streak, and track your progress.
Join free