first enter our keyword and if our keyword is reflecting in the html response then it is a reflected xss, if the keyword is reflecting in the dom then it is a dom xss.

search location. in the sources tab to identify the source.

then we need to check the sources for location.search, location.href if these are present in source tab then it is 100% dom xss.

in dom xss we will see the keyword only in dom not in view page source

• Source = A source is where data enters (URL bar, input field)
• Sink = where that data becomes executed

Sources: where attacker data enters JS:

• location.search — reads the ?query part
• location.hash — reads the #fragment part
• location.href — reads the whole URL
• document.URL — same as location.href
• document.referrer — reads where the user came from

Sinks: where data becomes dangerous:

• innerHTML — renders raw HTML
• document.write() — writes raw HTML
• eval() — executes a string as code
• location.href = — redirects the browser (can use javascript: protocol)
• element.src = — sets an image/script source