DOMXSS-03: Hash Fragment — VulnXSS Training Lab

DOMXSS-03 Hash Fragment Easy Unsolved Zenith Crypto Portfolio

Fictional Application

Zenith Crypto Portfolio

Multi-Asset Wealth & Portfolio Tracker

Zenith Portfolio lets cryptocurrency investors switch between asset tabs ('Overview', 'Holdings', 'Analytics'). The application uses the URL hash fragment (`#holdings`) to maintain client-side routing state. Investigate how the hash is extracted and rendered.

🎯 Assessment Objective

Craft a URL with a fragment identifier that executes arbitrary JavaScript when the page loads or hash changes.

Educational Guidance: Treat this lab like an authorized penetration test. Analyze user-controlled parameters, review browser source code and developer tools, and discover how input is handled.

Zenith Digital Assets

Decentralized Multi-Chain Vault & Swap

          BTC: $64,280.00
          ETH: $3,450.20
          SOL: $145.80
        

📊 Overview 🔄 Token Swap 🌱 Staking Pools 🔐 Hardware Vault

Portfolio Vault Overview

Total Vault Valuation: $184,920.45 USD
Select any navigation tab above to inspect dynamic blockchain telemetry.

Portfolio Vault Overview

XSS Successfully Demonstrated!