1. Feed a marker unique to you (test123) into every input you find — inputs, every parameter, everywhere.
2. Open devtools and search the page for the marker. Find every place it shows up. Context matters — here it lands inside a <p>.
3. Try plain HTML first: <u>test123</u>. Rendered as an underline? Then HTML goes in AND comes out → injection point.
4. Escalate to JavaScript: a <script> tag, or an event handler like onerror/onmouseover.
5. Test one parameter at a time — separately, with unique markers.

• Script tag: <script>alert(1)</script>
• Image error handler: <img src=x onerror=alert(1)>
• Hover handler: <button onmouseover=alert(1)>hover me</button>
• Real impact instead of popups: <button onmouseover=document.write(1)>hover me</button>

Why this works: the <script> tag tells the browser "run script here"; alert() is not what the bug is — it's just proof the JavaScript executed. Event handlers (onerror fires when the resource fails, onmouseover when you hover) run JavaScript on events instead of on page load.