DB.
Courses

Client-Side Attacks
OSCP · Chapter 8

Client-Side Attacks

Client-side attacks target the browser and the user rather than the server directly — cross-site scripting (XSS), malicious file downloads, and social-engineering payloads delivered via seemingly normal content.

Key concepts

  • Reflected XSS: a payload in the request is echoed back unescaped in the response, executing in the victim's browser.
  • Stored XSS: the payload is saved server-side (e.g. a comment) and executes for every visitor who views it — far more dangerous than reflected.
  • The fix is context-aware output encoding (HTML entity encoding, attribute encoding, JS string encoding) plus a strict Content-Security-Policy as defense in depth.
  • Client-side attacks are why "the server never trusted it" is not enough — the browser trusting your own site's HTML is the actual attack surface.

Example

<!-- Unescaped output — vulnerable -->
<div>Welcome, {{user_input}}</div>

<!-- If user_input = <img src=x onerror=alert(1)> the browser executes it -->

Try it yourself

On a lab app with a comment/guestbook feature, submit a benign marker payload like <b>test</b> and confirm whether it renders as bold text (unsafe) or literal text (safe output encoding).

ReferenceSearch video walkthroughs

@ Daniel Burlacu