I have read in multiple places contradictory views on what might be considered a DOM based XSS. It seems that the original definition says that it is a form of XSS where the payload originates exclusively from inside the browser, but some people also view it as a form of XSS where the payload may not necessarily originate from inside the browser, but is used to modify the DOM.
The second view is what confuses me. What exactly does it mean that the payload is used to modify the DOM? The OWASP page describing DOM XSS , gives an example which, to me seems to be the same as reflected XSS.
A DOM Based XSS attack against this page can be accomplished by sending the following URL to a victim:
http://www.some.site/page.html?default=<script>alert(document.cookie)</script>. When the victim clicks on this link, the browser sends a request for:
Since the payload is going from the victim's browser to the server and coming back to the browser, how is this not reflected XSS instead?
Should I interpret this as Reflected XSS means being able to injecting
<script> tags in an HTML context, and DOM based XSS means being able to inject payload inside an already existing