HOW the malicious URL/payload is delivered to the user?
In some cases (reflected XSS) it's phishing: "Hey check out thiswebsit.com?p=[XSS payload]" When the phished user visits the site the script executes in their browser.
In other cases (stored XSS) you may be able to store a script in say, a comment box that is displayed to every other visitor of the site: "Hey this is a great site! [XSS payload]. Now when any user visits the site and your comment is rendered the malicious script is also executed in their browser.
How does the attacker identify a site with a possible DOM based XSS vulnerability?
Burp was already mentioned, this is a great tool.
A very basic way to get started testing/understanding XSS is to ask yourself when viewing a page "What data do I control, and what data is displayed back to me?". If you can test these data points for script injection you are on your way to understanding XSS. Data points that commonly are vulnerable to basic XSS attacks are comments, usernames, profile details, error messages, and search parameters.