client-side

Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

Jump to install

Repository: transilienceai/communitytools
Last source activity: May 11, 2026 at 07:02
Detected SKILL.md language: English
Stars: 470
Forks: 73

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/transilienceai/communitytools --skill client-side

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

45 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

ai-threat-testing

Offensive AI security testing and exploitation framework. Systematically tests LLM applications for OWASP Top 10 vulnerabilities including prompt injection, model extraction, data poisoning, and supply chain attacks. Integrates with pentest workflows to discover and exploit AI-specific threats.

2026-07-29

cloud-containers

Cloud and container security testing - AWS, Azure, GCP, Docker, and Kubernetes misconfigurations and exploitation.

2026-07-29

pentest-engagement

Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500 hosts) — machine-prudent BATCHED tool-first nmap sweep (host discovery + bounded common+less-common port/service scan + CVE surfacing) with a uniform per-IP output tree, then bounded deep-dives on the highest-value hosts. The general (non-CTF) analogue of hackthebox/htb-solve.

2026-07-28

View all from this repository

name	client-side
description	Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

Client-Side

Test for client-side vulnerabilities across modern web applications and SPAs.

Techniques

Type	Key Vectors
XSS	Reflected, Stored, DOM-based, framework-specific (React, Vue, Angular)
CSRF	Token bypass, SameSite cookie bypass, cross-origin requests
CORS	Misconfigured origins, null origin, wildcard credentials
Clickjacking	Frame-based, drag-and-drop, multi-step
DOM-based	DOM sinks, source/sink analysis, JavaScript URL schemes
Prototype Pollution	Client-side gadgets, server-side pollution, property injection

Workflow

Identify input sources and data flows
Classify sink contexts (HTML, attribute, URL, JS, CSS)
Enumerate defenses (encoding, CSP, sanitizers, Trusted Types)
Craft context-appropriate payloads
Validate execution and demonstrate impact
Document with reproduction steps and remediation

Reference

reference/xss*.md - XSS bypass techniques and exploitation
reference/csrf*.md - CSRF techniques and bypasses
reference/cors*.md - CORS misconfiguration testing
reference/clickjacking*.md - Clickjacking techniques

client-side

Source facts

Install options

Review the source files

More from this repository

More from this repository

Client-Side

Techniques

Workflow

Reference

Client-Side

Techniques

Workflow

Reference