I'm studying the DOM based XSS attack. I understand that briefly is an attack where in the attack payload is executed as a result of modifying the DOM “environment” in the victim’s browser. But I do not understand becouse in many tutorial this attack is related to the use of special characther "#"(hash) in order to not send the malicius string to the server. can I use "#"(hash) only in this version or in reflected NOT DOM based too?
The URL hash isn't transmitted to the server. It's only available to the client, so the server is never aware of its value. Thus, non-DOM XSS isn't possible via URL hash.