I am attempting to (legally) XSS a website. This site doesn't have most of the common XSS issues, as it doesn't interact with the server and only uses local storage for its fields. However, I can still send a XMLHttpRequest() using a vulnerable field. I am attempting to prove I can cause reputational harm to the website as a potential problem with the vulnerable field, even if other XSS types are mitigated by the website's lack of functionality.

Questions:

1. Is there the ability to cause reputational harm by spamming or sending malicious requests using this method, that can be attributed to the "origin" on the site?
2. How is this any different from modifying Javascript directly in your browser, such that it sends the same sort of requests? In this case, the website's code isn't vulnerable, you changed it.

Thanks for any help!