A transit portal builds page behavior from untrusted URL fragments that flow into DOM sinks. What XSS theme does that illustrate?
Select an answer to reveal the explanation.
Short Explanation
Sometimes the server never echoes the payload — the browser’s own JavaScript reads a fragment and drops it into a dangerous sink. That is DOM XSS: the bug lives in client-side handling. No classic reflected HTML required.
Full Explanation
DOM-based XSS occurs when client-side code reads attacker-controllable data (such as URL fragments or other sources) and passes it into dangerous sinks without safe handling. Classic server-side reflection is not required for the class to exist. Confusing the issue with SQLi, SSI/FTP banners, or CSRF token optionality mis-labels the flaw. Testers should inspect client-side data flows when assessing modern civic portals.