What is the difference between 'reflected XSS', 'stored XSS', and 'DOM-based XSS' in terms of how the payload reaches the browser?

• A.Reflected XSS: payload is saved in the application database (cookies, session files) and served to all visitors on later requests - needs no crafted URL; stored XSS: payload comes from the current HTTP request (URL params) and is reflected in the server's HTML response - requires tricking the user into a crafted URL. DOM-based XSS: payload is filtered by the server before reaching the browser, with JavaScript reading it from the response header and writing it to a sink. Server-side WAFs can detect only DOM-based XSS; reflected and stored XSS are invisible to the server
• B.Reflected XSS: payload comes from the current HTTP request (URL params) and is reflected in the server's HTML response - requires tricking user into a crafted URL. Stored XSS: payload was saved server-side (database, file) and is served to all visitors. DOM-based XSS: payload doesn't pass through the server - JavaScript reads it from a client-controlled source (URL fragment, localStorage, postMessage) and writes it to a sink. Server-side WAFs can detect reflected and stored XSS; DOM-based XSS is invisible to the server