mn-youssef/security-skills/client-side-exploitation

Client-Side Exploitation (FIND/EXPLOIT — the browser & HTTP layer)

Overview

The presentation layer fails in ways scanners miss: client-side code, browser quirks, and the HTTP plumbing between the user and the server. This skill covers the advanced classes beyond the XSS/CSRF basics in security-code-audit/references/web-frontend.md.

Core principle: The browser executes whatever the page tells it to, and proxies/caches trust whatever parses cleanly. Attack the client's trust and the channel's assumptions.

Applies when / Skip when

• Applies when: the app serves a browser-rendered UI or ships client-side JavaScript.
• Skip when: API-only, CLI, daemon, or backend service with no browser surface → N/A.
• If N/A: report "client-side-exploitation: N/A — no frontend surface" and stop. This is the

canonical "skill doesn't match the app" case — skip cleanly, never force-fit browser tests.

⚠️ Authorization

Your own/authorized app. Request smuggling and cache poisoning can affect other users of a shared cache/proxy — test only on isolated staging you control.

Attack classes

See references/client-attacks.md for detection and PoC recipes.

High-value, often-missed

• CORS with credentials: the bug isn't * — it's reflecting the attacker's Origin while

allowing credentials. That leaks authenticated responses cross-site.

• Prototype pollution: library deep-merge of attacker JSON; chain to DOM XSS via a known gadget.
• Request smuggling: highest impact (mass session theft, cache poisoning, auth bypass) — test

carefully, isolated env only.

Output

Per finding: source→sink (for DOM/PP) or the desync/cache mechanics, the PoC, and who's affected (self vs other users — the latter raises severity sharply).

Hand-off

DOM XSS → often a foothold in vulnerability-chaining; reproduce via `active-pentest`; fix via `security-hardening` (encoding, strict CSP, exact-origin CORS, Object.freeze/null-proto, front/back server normalization).

Common mistakes

• Stopping at reflected/stored XSS — DOM XSS lives entirely in client JS and needs source→sink tracing.
• Reading CORS as "only * is bad" — credentialed origin reflection is the real flaw.
• Skipping request smuggling because it's "hard" — it's the highest-impact client-layer bug.
• Testing cache poisoning/smuggling on shared infra — you can hit real users; isolate first.