Client-Side Exploitation (FIND/EXPLOIT — the browser & HTTP layer)

Overview

The presentation layer fails in ways scanners miss: client-side code, browser quirks, and the HTTP plumbing between the user and the server. This skill covers the advanced classes beyond the XSS/CSRF basics in security-code-audit/references/web-frontend.md.

Core principle: The browser executes whatever the page tells it to, and proxies/caches trust whatever parses cleanly. Attack the client's trust and the channel's assumptions.

Applies when / Skip when

• Applies when: the app serves a browser-rendered UI or ships client-side JavaScript.
• Skip when: API-only, CLI, daemon, or backend service with no browser surface → N/A.
• If N/A: report "client-side-exploitation: N/A — no frontend surface" and stop. This is the canonical "skill doesn't match the app" case — skip cleanly, never force-fit browser tests.

⚠️ Authorization

Your own/authorized app. Request smuggling and cache poisoning can affect other users of a shared cache/proxy — test only on isolated staging you control.