So I have a reflected XSS vulnerability where I get a pop up by entering
<script>alert(2)</script> in the search field. I can't see this payload ('2') anywhere on the screen, neither if I view source.
What would be the correct approach to debug this XSS and find out where is the location it's being executed? Normally I would just open Developer Tools and use 'Pick an element on the web page' and click on payload and it would show, but in this case I don't know where it's located.
I imagine I could use breakpoints.