client-side-exploitation

Client-Side Exploitation (FIND/EXPLOIT — the browser & HTTP layer)

Overview

The presentation layer fails in ways scanners miss: client-side code, browser quirks, and the HTTP plumbing between the user and the server. This skill covers the advanced classes beyond the XSS/CSRF basics in security-code-audit/references/web-frontend.md.

Core principle: The browser executes whatever the page tells it to, and proxies/caches trust whatever parses cleanly. Attack the client's trust and the channel's assumptions.

Applies when / Skip when

• Applies when: the app serves a browser-rendered UI or ships client-side JavaScript.
• Skip when: API-only, CLI, daemon, or backend service with no browser surface → N/A.
• If N/A: report "client-side-exploitation: N/A — no frontend surface" and stop. This is the canonical "skill doesn't match the app" case — skip cleanly, never force-fit browser tests.

⚠️ Authorization

Your own/authorized app. Request smuggling and cache poisoning can affect other users of a shared cache/proxy — test only on isolated staging you control.

Attack classes

Class	What to test
DOM XSS	Source (location, postMessage, storage) → sink (innerHTML, eval) in client JS
CSP bypass	Weak CSP: unsafe-inline, wildcards, JSONP/Angular gadgets, base-uri missing
CORS exploitation	Server reflects arbitrary Origin + Allow-Credentials: true → cross-site data theft
postMessage abuse	Handlers that don't verify event.origin and feed data to a sink
Prototype pollution	Merging user JSON into Object.prototype → gadget → XSS/RCE/DoS
DOM clobbering	Injected id/name HTML overrides JS variables/functions
Clickjacking	No frame-ancestors/X-Frame-Options on sensitive actions
Web cache poisoning	Unkeyed input (headers) reflected + cached → served to others
Request smuggling	CL.TE / TE.CL desync between front-end and back-end servers

See references/client-attacks.md for detection and PoC recipes.

High-value, often-missed

• CORS with credentials: the bug isn't * — it's reflecting the attacker's Origin while allowing credentials. That leaks authenticated responses cross-site.
• Prototype pollution: library deep-merge of attacker JSON; chain to DOM XSS via a known gadget.
• Request smuggling: highest impact (mass session theft, cache poisoning, auth bypass) — test carefully, isolated env only.

Output

Per finding: source→sink (for DOM/PP) or the desync/cache mechanics, the PoC, and who's affected (self vs other users — the latter raises severity sharply).

Hand-off

DOM XSS → often a foothold in vulnerability-chaining; reproduce via active-pentest; fix via security-hardening (encoding, strict CSP, exact-origin CORS, Object.freeze/null-proto, front/back server normalization).

Common mistakes

• Stopping at reflected/stored XSS — DOM XSS lives entirely in client JS and needs source→sink tracing.
• Reading CORS as "only * is bad" — credentialed origin reflection is the real flaw.
• Skipping request smuggling because it's "hard" — it's the highest-impact client-layer bug.
• Testing cache poisoning/smuggling on shared infra — you can hit real users; isolate first.