I'm studying the DOM based XSS attack. I understand that briefly is an attack where in the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser. But I do not understand becouse in many tutorial this attack is related to the use of special characther "#"(hash) in order to not send the malicius string to the server. can I use "#"(hash) only in this version or in reflected NOT DOM based too?

  • 1
    A value after the fragment identifier (#) is never actually sent. Therefore it can't be reflected as in a reflected XSS attack.
    – Arminius
    Jun 9, 2017 at 22:01
  • Is the use of "#" mandatory for DOM XSS? I'm a bit confused becouse I see many example where "#" is not use, but if I do not use it I send the information to the server and it is a Reflected XSS.
    – Bob
    Jun 11, 2017 at 16:48
  • It's the other way round: When the payload is sent as the URL fragment, then it (almost always) has to be DOM XSS. But not every DOM XSS works via URL fragments.
    – Arminius
    Jun 11, 2017 at 16:52
  • Thus, for example using an optional query: some.site/page.html?default=1 The part default=1 si no send to the server?
    – Bob
    Jun 11, 2017 at 17:00
  • A query part is sent. But here, the fragment wouldn't be: some.site/page.hmtl#default=1
    – Arminius
    Jun 11, 2017 at 17:07

1 Answer 1


The URL hash isn't transmitted to the server. It's only available to the client, so the server is never aware of its value. Thus, non-DOM XSS isn't possible via URL hash.

Since the client is aware of its value, it could try to use it, fail to sanitize its value, and insert malicious markup / execute some Javascript code, leading to a DOM XSS vulnerability.

  • Then for the DOM-based I no need to add javascript code in webpage using a vulnerable server, but I can change the HTML directely from the user's browser changing the DOM, right?
    – Bob
    Jun 10, 2017 at 9:20
  • For a DOM-based XSS, the server must send vulnerable JavaScript. If you were able to send JavaScript from the server, then it would be a classical (not DOM) XSS. Jun 10, 2017 at 9:29
  • Thus the use of "#" is not mandatory for DOM XSS?
    – Bob
    Jun 11, 2017 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.