I am struggling to understand whether the following would be considered as a DOM-based XSS or reflected XSS and was hoping that someone could help me distinguish the the difference.
Imagine the following scenario:
Imagine that a site has a search functionality in which the user supplies input in a GET request e.g.
var searchResult = *userdata*
The attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser used by the original client side script, so that the client side code runs in an “unexpected” manner. That is, the page itself (the HTTP response that is) does not change, but the client side code contained in the page executes differently due to the malicious modifications that have occurred in the DOM environment.
So does the fact that the user input changes the client side script received back to the user, make this a reflective XSS?