A mental model of XSS attack

Mental Model Difference

Stored XSS

💣 You leave a bomb in the app.

Reflected XSS

🎣 You send a poisoned link.

DOM XSS

🪞 The frontend poisons itself using user-controlled data.