Reading about DOM based XSS from http://www.webappsec.org/projects/articles/071105.shtml 

It illustrates some examples like:

http://www.vulnerable.site/welcome.html?foobar=name=<script>alert(document.cookie)<script>&name=Joe


and

 http://www.vulnerable.site/attachment.cgi?id=&action=foobar#<script>alert(document.cookie)</script>


1) In what sequence does a server and a browser parse javascript? Let's say for example 1), as soon as the above request is typed in a browser and sent to vulnerable.site, the cgi would handle the request via GET/POST parameters. Here, it would extract the required values from the GET/POST request, do some server side processing and return back a response in html. So where is the javascript in one of the parameters embedded in the response?

2) Similarly, for example 2) i read that # character would prevent the  to be sent to the server side. So the server will only receive a request like      http://www.vulnerable.site/attachment.cgi?id=&action=foobar and not the complete url. So what happens to the javascript that follows? Does the browser run it directly?

You don't punish the hacker. The law does. Just report whatever pieces of information you have to the police and let them handle it.

However, it is very unlikely that the attacker will be caught. The IP address you posses most likely belongs to another system that the attacker has compromised and is using as a proxy. Just treat it as a lesson learnt and move on.
