I'm studying the DOM based XSS attack. I understand that briefly is an attack where in the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser. But I do not understand becouse in many tutorial this attack is related to the use of special characther "#"(hash) in order to not send the malicius string to the server. can I use "#"(hash) only in this version or in reflected NOT DOM based too?

  • 1
    A value after the fragment identifier (#) is never actually sent. Therefore it can't be reflected as in a reflected XSS attack.
    – Arminius
    Jun 9, 2017 at 22:01
  • Is the use of "#" mandatory for DOM XSS? I'm a bit confused becouse I see many example where "#" is not use, but if I do not use it I send the information to the server and it is a Reflected XSS.
    – Bob
    Jun 11, 2017 at 16:48
  • It's the other way round: When the payload is sent as the URL fragment, then it (almost always) has to be DOM XSS. But not every DOM XSS works via URL fragments.
    – Arminius
    Jun 11, 2017 at 16:52
  • Thus, for example using an optional query: some.site/page.html?default=1 The part default=1 si no send to the server?
    – Bob
    Jun 11, 2017 at 17:00
  • A query part is sent. But here, the fragment wouldn't be: some.site/page.hmtl#default=1
    – Arminius
    Jun 11, 2017 at 17:07

1 Answer 1


The URL hash isn't transmitted to the server. It's only available to the client, so the server is never aware of its value. Thus, non-DOM XSS isn't possible via URL hash.

Since the client is aware of its value, it could try to use it, fail to sanitize its value, and insert malicious markup / execute some Javascript code, leading to a DOM XSS vulnerability.

  • Then for the DOM-based I no need to add javascript code in webpage using a vulnerable server, but I can change the HTML directely from the user's browser changing the DOM, right?
    – Bob
    Jun 10, 2017 at 9:20
  • For a DOM-based XSS, the server must send vulnerable JavaScript. If you were able to send JavaScript from the server, then it would be a classical (not DOM) XSS. Jun 10, 2017 at 9:29
  • Thus the use of "#" is not mandatory for DOM XSS?
    – Bob
    Jun 11, 2017 at 16:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .