<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-client-side-security-testing
description: >-
  Test client-side security including DOM-based XSS, postMessage
  vulnerabilities, insecure client-side storage, CSP bypass, CORS
  misconfiguration, JavaScript prototype pollution, and clickjacking.
domain: cybersecurity
subdomain: application-security
tags:
  - client-side
  - dom-xss
  - csp
  - cors
  - postmessage
  - clickjacking
  - owasp-a03
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.007", "T1185"]
  owasp-top10: ["A03", "A05"]
  tools: ["burp-suite", "dalfox", "retire.js", "semgrep"]
---

# Performing Client Side Security Testing

## Overview

Client-side vulnerabilities exploit the browser environment including
DOM-based XSS through unsafe JavaScript sinks, postMessage handler flaws,
insecure local/session storage, CSP bypasses, and CORS misconfigurations.

## Prerequisites

- Tools: ["burp-suite", "dalfox", "retire.js", "semgrep"]
- Authorized testing engagement with written scope
- Target application access and credentials

## Workflow

### Step 1: DOM XSS Analysis

```bash
# Identify DOM XSS sources and sinks
curl -s https://target.com | grep -oE \
  "location\.hash|location\.search|document\.URL|window\.name|document\.referrer"

curl -s https://target.com | grep -oE \
  "innerHTML|outerHTML|document\.write|eval\(|setTimeout\(|setInterval\("

# Semgrep DOM XSS analysis
semgrep --config=p/xss --config=p/javascript src/

# Dalfox DOM XSS scan
dalfox url "https://target.com/page?q=test" --deep-domxss
```

### Step 2: CSP Analysis and Bypass

```bash
# Retrieve CSP header
curl -sI https://target.com | grep -i "content-security-policy"

# Evaluate CSP with Google CSP Evaluator
# https://csp-evaluator.withgoogle.com/

# Common CSP bypasses:
# unsafe-inline → direct script injection
# unsafe-eval → eval-based XSS
# *.googleapis.com → JSONP callback abuse
# data: in script-src → data:text/html,<script>alert(1)</script>
```

### Step 3: CORS Misconfiguration

```bash
# Test CORS with arbitrary origin
curl -sI https://target.com/api/data \
  -H "Origin: https://evil.com" | grep -i "access-control"

# Test null origin
curl -sI https://target.com/api/data \
  -H "Origin: null" | grep -i "access-control"

# Test wildcard with credentials
curl -sI https://target.com/api/data \
  -H "Origin: https://evil.com" | grep -i "access-control-allow-credentials"
```

### Step 4: Clickjacking and Storage

```bash
# Check X-Frame-Options and frame-ancestors
curl -sI https://target.com | grep -iE "x-frame-options|content-security-policy"

# Check for sensitive data in client-side storage
# Browser console: localStorage, sessionStorage, document.cookie

# retire.js for vulnerable JavaScript libraries
retire --js --path=src/
retire --js --jsrepo --outputformat json
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| DOM XSS trigger | CSP reports | CSP violation reports from inline scripts |
| CORS abuse | Access logs | Requests with suspicious Origin header |
| Clickjacking | CSP reports | Frame embedding from unauthorized domains |

```yaml
title: Client Side Security Testing Detection
id: 1a896fc4-396e-435e-9355-bbd5f54a6147
status: experimental
description: Detects suspicious activity related to performing client side security testing techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1059.007
  - attack.t1185
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] All relevant attack vectors tested
- [ ] Findings documented with severity and evidence
- [ ] Detection artifacts identified
- [ ] Remediation recommendations provided

## References

- [OWASP Testing Guide](https://owasp.org/www-project-web-security-testing-guide/)
- [MITRE ATT&CK](https://attack.mitre.org/)
