skills.rest
MaiconGambini
MaiconGambiniCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

wstg-client-side

Tests web applications for client-side vulnerabilities following the OWASP WSTG v4.2 methodology.

Updated Jul 29, 2026
Search Tags:#owasp#clickjacking#penetration testing#web security#cors#dom xss#wstg
One-click install
npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill wstg-client-side-maicongambini
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: wstg-client-side
Source: https://github.com/MaiconGambini/opencode-harness-guide/tree/main/skills/wstg-client-side
Command: npx skills add https://github.com/MaiconGambini/opencode-harness-guide --skill wstg-client-side-maicongambini

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Penetration testers and security assessors need a structured, repeatable methodology for finding client-side vulnerabilities like DOM-based XSS, clickjacking, and insecure CORS configurations that server-side scanners and WAFs routinely miss. ## Core Features & Use Cases - Complete WSTG-CLNT Coverage: Provides testing procedures for all 13 OWASP WSTG v4.2 client-side test cases, from DOM-based XSS to Cross Site Script Inclusion. - Source-to-Sink Analysis Guidance: Explains how to trace attacker-controlled data from browser sources (location.hash, postMessage, storage) to dangerous sinks (innerHTML, eval, document.write). - Remediation Mapping: Each test case includes a remediation summary table pairing primary fixes (e.g., DOMPurify, X-Frame-Options) with secondary defenses (e.g., CSP, SRI). - Use Case: During a web application penetration test, use this Skill to systematically audit a single-page application for DOM XSS by tracing location.hash usage into innerHTML sinks, then verify clickjacking protections on sensitive pages. ## Quick Start Use the wstg-client-side skill to test this web application for DOM-based XSS and clickjacking vulnerabilities.

Frequently Asked Questions about wstg-client-side

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for DOM-based XSS vulnerabilities?▼

DOM-based XSS testing traces attacker-controlled sources like location.hash, document.referrer, and postMessage data to execution sinks such as innerHTML, eval, and document.write. Because payloads never reach the server, manual source-to-sink tracing in JavaScript code is essential since automated scanners miss these flows.

What is the OWASP WSTG client-side testing methodology?▼

The OWASP Web Security Testing Guide v4.2 defines 13 client-side test cases (WSTG-CLNT-01 through CLNT-13) covering DOM XSS, JavaScript execution, HTML/CSS injection, URL redirects, CORS, clickjacking, WebSockets, web messaging, browser storage, and cross-site script inclusion.

How do I test CORS configuration for security issues?▼

Inspect responses for Access-Control-Allow-Origin headers and check for wildcard origins combined with credentials, or reflected Origin headers without validation. Send preflight OPTIONS requests to enumerate allowed methods, and test whether arbitrary origins can read authenticated responses.

How do I check if a website is vulnerable to clickjacking?▼

Attempt to load the target page inside an iframe on a test page; if it renders, no framing protection exists. Then verify X-Frame-Options and CSP frame-ancestors headers on all sensitive pages, including mobile versions, and test bypasses of client-side frame-busting scripts.

Why is storing JWT tokens in localStorage a security risk?▼

localStorage is readable by any JavaScript running on the same origin, so a single XSS vulnerability exposes the token to attackers. Session tokens should use HttpOnly, Secure, SameSite cookies instead, which JavaScript cannot access.

What are the limitations of automated scanners for client-side testing?▼

Automated scanners observe payloads in server responses, so they miss DOM XSS where data never leaves the browser, conditional flows hidden behind browser detection, and URL fragment attacks. Manual source-to-sink analysis and headless browser crawling are required for full coverage.

Related Skills

Explore More Software Engineering Skills→
bpnrockstarbpnrockstar

web2-recon

Automate web2 reconnaissance with subdomain discovery, live host enumeration, URL crawling, and JavaScript bundle analysis.

Community
Advanced
kaminocorpkaminocorp
1

exploit-development

Develops proof-of-concept exploits for verified vulnerabilities in authorized security testing.

Official
Advanced
nuxt-modulesnuxt-modules
134

nuxt-better-auth

Integrate Better Auth authentication and session management into Nuxt.js applications.

Official
Advanced
securityfortechsecurityfortech
6

dom-xss

Audit JavaScript for DOM XSS tainted data flow from sources to sinks.

Official
Intermediate