> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/web/xss/dom-xss-with-jquery-hashchange-event.md).
# DOM XSS with jQuery and hashchange
DOM XSS with jQuery and hashchange notes for PortSwigger Web Security Academy labs, including exploitation workflow, payload testing, Burp Suite validation, and remediation context.
### DOM XSS in JQuery Selector Sink Using a Hashchange Event
This lab contains a client-side XSS vulnerability on the homepage. The code uses the `$()` selector function of jQuery to automatically target an article whose title has passed via `location.hash`. The goal of the lab is to obtain an exploit that, when a visitor opens it, calls `print()` in his browser.
{% code overflow="wrap" %}
```javascript
$(window).on('hashchange', function(){
var post = $('section.blog-list h2:contains(' + decodeURIComponent(window.location.hash.slice(1)) + ')');
if (post) post.get(0).scrollIntoView();
});
```
{% endcode %}
* The function recovers the URL fragment (`window.location.hash`), removes the `#` with `slice(1)` and decodes it with `decodeURIComponent`.
* This text is then concatenated directly in a jQuery `:contains(...)` selector. Since there is no exhaust, specially constructed content can break the syntax and inject HTML/JS via vectors such as `onerror` attributes.
* The code only triggers the action when the hash changes (`hashchange`), so a simple initial link without hash will not trigger anything until the fragment is changed on the customer side.
* We take advantage of the fact that the modification of `#` triggers the event. The exploit must therefore force the victim's browser to load a URL with a fragment containing the payload.
* A common method is to use a `
```
{% endcode %}
* Final Exploit for `print()` (adapted version):
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/web/xss/dom-xss-with-jquery-hashchange-event.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
