DOM XSS Test Lab

Static webpage designed to test XSS scanners like Dalfox

1. Query string → innerHTML Vulnerable

Reads ?q= and writes it into the DOM unescaped.

Try: ?q=<img src=x onerror=alert(1)>

2. URL fragment (hash) → innerHTML Vulnerable

Reads # fragment and writes it into the DOM unescaped. Fragment values never reach the server at all, so this is a purely client-side (DOM-based) vector — a server-side scanner or WAF logs won't see the payload.

Try: #<img src=x onerror=alert(2)> (reload after editing the hash, since hashchange is also wired up below)

3. Query string → document.write Vulnerable

Reads ?name= and writes it via document.write, another classic sink.

Try: ?name=<script>alert(3)</script>

4. Query string → safe text rendering Safe

Reads ?safe= but uses textContent instead of innerHTML, so any HTML/script in the input is displayed as literal text, not executed.

Try the same payload: ?safe=<img src=x onerror=alert(4)> — it will show up as plain text, not run.