SkillsAdd

mn-youssef/security-skills

client-side-exploitation

Use when testing advanced browser-side and HTTP-layer attacks beyond basic XSS/CSRF — DOM XSS, CSP bypass, CORS misconfiguration exploitation, postMessage abuse, prototype pollution, DOM clobbering, clickjacking, web cache poisoning, and HTTP request smuggling.

First seen Jun 8, 2026

Installation

$ npx skills add mn-youssef/security-skills --skill client-side-exploitation
View on skills.sh ↗ GitHub repository ↗

Summary

  • Use when testing advanced browser-side and HTTP-layer attacks beyond basic XSS/CSRF — DOM XSS, CSP bypass, CORS misconfiguration exploitation, postMessage abuse, prototype pollution, DOM clobbering, clickjacking, web cache poisoning, and HTTP request smuggling.
  • On apps you own or are authorized to test.

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs
azure-validate Same topic
microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure…

567.7K installs
azure-aigateway Same topic
microsoft/azure-skills

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: sem…

566.3K installs
azure-compute Same topic
microsoft/azure-skills

Azure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compar…

510K installs
supabase-postgres-best-practices Same topic
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs

Also in this package

Other skills from mn-youssef/security-skills · top by installs.

npx skills add mn-youssef/security-skills
file-upload-and-ssrf 35 pentest-reporting 35 recon-and-osint 34 security-testing 34 authentication-testing 33 api-security-testing 32 vulnerability-chaining 32 active-pentest 32 access-control-testing 32 business-logic-testing 31

Browse all from mn-youssef/security-skills

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 45
License LICENSE
Default branch master
Open issues 0
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 3,701 B
  • docs SUMMARY.md 338 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 35 installs

SKILL.md

Client-Side Exploitation (FIND/EXPLOIT — the browser & HTTP layer)

Overview

The presentation layer fails in ways scanners miss: client-side code, browser quirks, and the HTTP plumbing between the user and the server. This skill covers the advanced classes beyond the XSS/CSRF basics in security-code-audit/references/web-frontend.md.

Core principle: The browser executes whatever the page tells it to, and proxies/caches trust whatever parses cleanly. Attack the client's trust and the channel's assumptions.

Applies when / Skip when

  • Applies when: the app serves a browser-rendered UI or ships client-side JavaScript.
  • Skip when: API-only, CLI, daemon, or backend service with no browser surface → N/A.
  • If N/A: report "client-side-exploitation: N/A — no frontend surface" and stop. This is the

canonical "skill doesn't match the app" case — skip cleanly, never force-fit browser tests.

⚠️ Authorization

Your own/authorized app. Request smuggling and cache poisoning can affect other users of a shared cache/proxy — test only on isolated staging you control.

Attack classes

Class What to test
DOM XSS Source (location, postMessage, storage) → sink (innerHTML, eval) in client JS
CSP bypass Weak CSP: unsafe-inline, wildcards, JSONP/Angular gadgets, base-uri missing
CORS exploitation Server reflects arbitrary Origin + Allow-Credentials: true → cross-site data theft
postMessage abuse Handlers that don't verify event.origin and feed data to a sink
Prototype pollution Merging user JSON into Object.prototype → gadget → XSS/RCE/DoS
DOM clobbering Injected id/name HTML overrides JS variables/functions
Clickjacking No frame-ancestors/X-Frame-Options on sensitive actions
Web cache poisoning Unkeyed input (headers) reflected + cached → served to others
Request smuggling CL.TE / TE.CL desync between front-end and back-end servers

See references/client-attacks.md for detection and PoC recipes.

High-value, often-missed

  • CORS with credentials: the bug isn't — it's reflecting* the attacker's Origin while

allowing credentials. That leaks authenticated responses cross-site.

  • Prototype pollution: library deep-merge of attacker JSON; chain to DOM XSS via a known gadget.
  • Request smuggling: highest impact (mass session theft, cache poisoning, auth bypass) — test

carefully, isolated env only.

Output

Per finding: source→sink (for DOM/PP) or the desync/cache mechanics, the PoC, and who's affected (self vs other users — the latter raises severity sharply).

Hand-off

DOM XSS → often a foothold in vulnerability-chaining; reproduce via active-pentest; fix via security-hardening (encoding, strict CSP, exact-origin CORS, Object.freeze/null-proto, front/back server normalization).

Common mistakes

  • Stopping at reflected/stored XSS — DOM XSS lives entirely in client JS and needs source→sink tracing.
  • Reading CORS as "only is bad" — credentialed origin reflection* is the real flaw.
  • Skipping request smuggling because it's "hard" — it's the highest-impact client-layer bug.
  • Testing cache poisoning/smuggling on shared infra — you can hit real users; isolate first.