The name comes from the URL fragment and is written with innerHTML. The server never sees it: /labs/dom#<img src=x onerror=alert(document.domain)>. Then submit the flag manually: this one is flag{cwap_dom_xss_hash_sink} once you fire it.
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only