Analyze JavaScript fetch() and XHR requests for Client-Side Path Traversal vulnerabilities.
npx skills add https://github.com/securityfortech/hacking-skills --skill cspt
Please help me install this Agent Skill. Skill: cspt Source: https://github.com/securityfortech/hacking-skills/tree/main/skills/web/client-side/cspt Command: npx skills add https://github.com/securityfortech/hacking-skills --skill cspt
This Skill helps identify and exploit Client-Side Path Traversal (CSPT) vulnerabilities, where user input in JavaScript fetch/XHR requests can be manipulated to access unintended resources or redirect requests.
fetch() or XHR requests.fetch calls and helps you craft a payload to redirect the request to an attacker-controlled server, demonstrating an open redirect vulnerability.Analyze the provided JavaScript code for instances of user input being concatenated into fetch() or XHR request paths.
High-intent search queries and answers about installing and using this skill.
Client-side path traversal (CSPT) occurs when user input is unsafely concatenated into the URL path of fetch() or XHR requests, allowing attackers to manipulate the path and access unintended resources or redirect requests.
Analyze JavaScript code for instances where user input is directly concatenated into fetch() or XHR request paths. This identifies vulnerable calls where traversal payloads can be crafted to redirect requests.
Yes, in SPA frameworks, client-side path traversal can manipulate DOM elements and redirect fetch requests, potentially leading to cross-site scripting (XSS) impact through malicious resource loading or data exfiltration.
Bypass WAFs by applying various encoding strategies to the traversal payloads. This obfuscates the malicious path sequences in fetch and XHR requests, evading pattern-based firewall detection.
Craft payloads using path traversal sequences to test the depth of URL manipulation in vulnerable fetch() calls. This methodology helps determine if the request can be redirected to an attacker-controlled server.
Big-fat-dogTrace JavaScript encryption parameters to their generating function and call path via static code analysis and XHR breakpoints.
securityfortechDetect and exploit CORS misconfigurations in web applications.
Kisilev13Detect and analyze file upload vulnerabilities including RCE, XSS, SSRF, and path traversal.
snowdamizBuild HTTP servers with routing, middleware, and WebSocket support.