← All labs
XSS Level 5 / 10 Medium

DOM — Hash Sink

Client-side JavaScript writes location data into the page. No server reflection involved.

Welcome page

This page greets you using the URL fragment (the part after #). Nothing is sent to the server — everything happens in your browser.

Try appending, e.g. #Ada to the address bar and reloading.

Welcome, guest!

This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of Uncrypt Playground is not part of the target.