mn-youssef Client-Side Exploitation (FIND/EXPLOIT — the browser & HTTP layer)
Overview
The presentation layer fails in ways scanners miss: client-side code, browser quirks, and the
HTTP plumbing between the user and the server. This skill covers the advanced classes beyond the
XSS/CSRF basics in security-code-audit/references/web-frontend.md.
Core principle: The browser executes whatever the page tells it to, and proxies/caches trust whatever parses cleanly. Attack the client's trust and the channel's assumptions.
Applies when / Skip when
- Applies when: the app serves a browser-rendered UI or ships client-side JavaScript.
- Skip when: API-only, CLI, daemon, or backend service with no browser surface → N/A.
- If N/A: report "client-side-exploitation: N/A — no frontend surface" and stop. This is the canonical "skill doesn't match the app" case — skip cleanly, never force-fit browser tests.
⚠️ Authorization
Your own/authorized app. Request smuggling and cache poisoning can affect other users of a shared cache/proxy — test only on isolated staging you control.
Attack classes
| Class | What to test |
|---|---|
| DOM XSS | Source (location, postMessage, storage) → sink (innerHTML, eval) in client JS |
| CSP bypass | Weak CSP: unsafe-inline, wildcards, JSONP/Angular gadgets, base-uri missing |
| CORS exploitation | Server reflects arbitrary Origin + Allow-Credentials: true → cross-site data theft |
| postMessage abuse | Handlers that don't verify event.origin and feed data to a sink |
| Prototype pollution | Merging user JSON into Object.prototype → gadget → XSS/RCE/DoS |
| DOM clobbering | Injected id/name HTML overrides JS variables/functions |
| Clickjacking | No frame-ancestors/X-Frame-Options on sensitive actions |
| Web cache poisoning | Unkeyed input (headers) reflected + cached → served to others |
| Request smuggling | CL.TE / TE.CL desync between front-end and back-end servers |
See references/client-attacks.md for detection and PoC recipes.
High-value, often-missed
- CORS with credentials: the bug isn't
*— it's reflecting the attacker'sOriginwhile allowing credentials. That leaks authenticated responses cross-site. - Prototype pollution: library deep-merge of attacker JSON; chain to DOM XSS via a known gadget.
- Request smuggling: highest impact (mass session theft, cache poisoning, auth bypass) — test carefully, isolated env only.
Output
Per finding: source→sink (for DOM/PP) or the desync/cache mechanics, the PoC, and who's affected (self vs other users — the latter raises severity sharply).
Hand-off
DOM XSS → often a foothold in vulnerability-chaining; reproduce via active-pentest;
fix via security-hardening (encoding, strict CSP, exact-origin CORS, Object.freeze/null-proto,
front/back server normalization).
Common mistakes
- Stopping at reflected/stored XSS — DOM XSS lives entirely in client JS and needs source→sink tracing.
- Reading CORS as "only
*is bad" — credentialed origin reflection is the real flaw. - Skipping request smuggling because it's "hard" — it's the highest-impact client-layer bug.
- Testing cache poisoning/smuggling on shared infra — you can hit real users; isolate first.