<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Client Side Security Testing

## dalfox — XSS Scanner
```bash
dalfox url "URL?q=test" --deep-domxss
dalfox url "URL?q=test" --blind https://callback.xss.ht
```

## retire.js — Vulnerable Libraries
```bash
retire --js --path=src/ --outputformat json
```

## curl — Header Analysis
```bash
# CORS test
curl -sI URL -H "Origin: https://evil.com" | grep -i access-control

# CSP analysis
curl -sI URL | grep -i content-security-policy

# Clickjacking check
curl -sI URL | grep -i x-frame-options
```

## semgrep — Client-Side Analysis
```bash
semgrep --config=p/xss --config=p/javascript src/
```
