Client-Side Attacks
Client-Side Attacks covers XSS, CSRF, prototype pollution, and DOM clobbering. CWEE tests whether you can trace data from a controllable source to a dangerous sink, then show a realistic consequence such as session abuse, account takeover, or privilege escalation.
Sources, sinks, and defenses
For XSS, identify reflected, stored, and DOM-based paths. Trace location.hash, postMessage, document.referrer, and API responses into sinks such as innerHTML, eval, setTimeout, and jQuery selectors. Check CSP, HttpOnly, and output encoding. For CSRF, verify whether state-changing requests rely only on cookies and whether anti-CSRF tokens or SameSite are enforced. Prototype pollution arises when recursive merges accept __proto__, constructor.prototype, or prototype; DOM clobbering uses named elements and id attributes to shadow globals.
Worked example
A profile merge endpoint accepts JSON and recursively merges it. Sending {"__proto__":{"isAdmin":true}} pollutes Object.prototype. A later authorization check reads user.isAdmin and grants admin UI access. The proof is the polluted property plus the changed response, not just a JavaScript error.
Traps
Alert boxes are not impact. Self-XSS requiring the victim to paste code is usually low value. HttpOnly blocks cookie theft but not CSRF or authenticated actions. CSP may allow JSONP or unsafe-inline paths. Prototype pollution needs a consumer that reads the polluted property; DOM clobbering needs a script that trusts a global name.