# Client Side Exploitation

> Use when testing advanced browser-side and HTTP-layer attacks beyond basic XSS/CSRF — DOM XSS, CSP bypass, CORS misconfiguration exploitation, postMessage abuse, prototype pollution, DOM clobbering, clickjacking, web cache poisoning, and HTTP request smuggling. On apps you own or are authorized to test.

- Skill: `mn-youssef/client-side-exploitation` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add mn-youssef/client-side-exploitation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mn-youssef/client-side-exploitation/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: mn-youssef (https://skillmd.com/u/mn-youssef)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mn-youssef/client-side-exploitation

---


# Client-Side Exploitation (FIND/EXPLOIT — the browser & HTTP layer)

## Overview
The presentation layer fails in ways scanners miss: client-side code, browser quirks, and the
HTTP plumbing between the user and the server. This skill covers the advanced classes beyond the
XSS/CSRF basics in `security-code-audit/references/web-frontend.md`.

**Core principle:** The browser executes whatever the page tells it to, and proxies/caches trust
whatever parses cleanly. Attack the *client's* trust and the *channel's* assumptions.

## Applies when / Skip when
- **Applies when:** the app serves a browser-rendered UI or ships client-side JavaScript.
- **Skip when:** API-only, CLI, daemon, or backend service with no browser surface → N/A.
- **If N/A:** report "client-side-exploitation: N/A — no frontend surface" and stop. This is the
  canonical "skill doesn't match the app" case — skip cleanly, never force-fit browser tests.

## ⚠️ Authorization
Your own/authorized app. Request smuggling and cache poisoning can affect *other users* of a
shared cache/proxy — test only on isolated staging you control.

## Attack classes
| Class | What to test |
|-------|--------------|
| DOM XSS | Source (`location`, `postMessage`, storage) → sink (`innerHTML`, `eval`) in client JS |
| CSP bypass | Weak CSP: `unsafe-inline`, wildcards, JSONP/Angular gadgets, `base-uri` missing |
| CORS exploitation | Server reflects arbitrary `Origin` + `Allow-Credentials: true` → cross-site data theft |
| postMessage abuse | Handlers that don't verify `event.origin` and feed data to a sink |
| Prototype pollution | Merging user JSON into `Object.prototype` → gadget → XSS/RCE/DoS |
| DOM clobbering | Injected `id`/`name` HTML overrides JS variables/functions |
| Clickjacking | No `frame-ancestors`/`X-Frame-Options` on sensitive actions |
| Web cache poisoning | Unkeyed input (headers) reflected + cached → served to others |
| Request smuggling | CL.TE / TE.CL desync between front-end and back-end servers |

See `references/client-attacks.md` for detection and PoC recipes.

## High-value, often-missed
- **CORS with credentials:** the bug isn't `*` — it's *reflecting* the attacker's `Origin` while
  allowing credentials. That leaks authenticated responses cross-site.
- **Prototype pollution:** library deep-merge of attacker JSON; chain to DOM XSS via a known gadget.
- **Request smuggling:** highest impact (mass session theft, cache poisoning, auth bypass) — test
  carefully, isolated env only.

## Output
Per finding: source→sink (for DOM/PP) or the desync/cache mechanics, the PoC, and who's affected
(self vs other users — the latter raises severity sharply).

## Hand-off
DOM XSS → often a foothold in `vulnerability-chaining`; reproduce via **`active-pentest`**;
fix via **`security-hardening`** (encoding, strict CSP, exact-origin CORS, `Object.freeze`/null-proto,
front/back server normalization).

## Common mistakes
- Stopping at reflected/stored XSS — DOM XSS lives entirely in client JS and needs source→sink tracing.
- Reading CORS as "only `*` is bad" — credentialed origin *reflection* is the real flaw.
- Skipping request smuggling because it's "hard" — it's the highest-impact client-layer bug.
- Testing cache poisoning/smuggling on shared infra — you can hit real users; isolate first.