mcpField
P
pentest-client-advanced

pentest-client-advanced

github.com/jd-opensourceSecurity31548 installsUpdated 28w ago
Repository

About pentest-client-advanced

A security-testing skill for client-side attack surfaces beyond XSS, covering six WSTG-CLNT categories. It provides workflows for browser-based verification and proof-of-concept construction.

Key features

  1. 01CORS misconfiguration testing
  2. 02WebSocket security checks
  3. 03Clickjacking assessment
  4. 04postMessage origin and input checks
  5. 05CSS injection and client-side storage analysis
  6. 06Browser-based attack PoC construction

Use cases

  1. 01Test cross-origin access and WebSocket protections
  2. 02Assess clickjacking and postMessage handling
  3. 03Inspect browser storage for sensitive data

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jd-opensource/joysafeter --skill pentest-client-advanced

After installing, type/pentest-client-advancedin Claude Code to confirm it loaded.

Bundled filesreferences/tools.mdreferences/workflows.md

Details

From the project README

Pentest Client Advanced

Purpose

Test advanced client-side attack surfaces beyond XSS. Six WSTG-CLNT items remain unchecked in Shannon's pipeline — these are distinct attack classes requiring different methodology than taint analysis.

Prerequisites

Authorization Requirements
  • Written authorization with client-side testing scope
  • Test domains for hosting PoC HTML pages (attacker-controlled origin)
  • Browser testing environment with DevTools access
  • Target user simulation — ability to test cross-origin interactions
Environment Setup
  • Modern browser with DevTools (Chrome/Firefox)
  • Burp Suite for intercepting WebSocket and cross-origin traffic
  • Local HTTP server for hosting PoC pages (python -m http.server)
  • Playwright for automated browser-based attack verification

Core Workflow

  1. CORS Misconfiguration: Test reflected Origin in ACAO header, null origin bypass, subdomain wildcard abuse, credential leakage via cross-origin requests (WSTG-CLNT-07).
  2. WebSocket Security: Missing auth on WS upgrade, CSWSH (Cross-Site WebSocket Hijacking), injection through WS messages, missing origin validation (WSTG-CLNT-10).
  3. Clickjacking: Missing X-Frame-Options / CSP frame-ancestors, UI redressing, drag-and-drop hijacking, multi-step clickjacking chains (WSTG-CLNT-09).
  4. postMessage Abuse: Missing origin validation in message handlers, DOM manipulation via cross-origin messages, prototype pollution through postMessage (WSTG-CLNT-11).
  5. CSS Injection: Data exfiltration via CSS attribute selectors + background-image, CSS-based keylogging, style injection for UI manipulation (WSTG-CLNT-05).
  6. Client-Side Storage: Sensitive data in localStorage/sessionStorage, IndexedDB exposure, service worker cache poisoning (WSTG-CLNT-06).
  7. PoC Construction: Build HTML pages demonstrating each attack with real impact.

WSTG Coverage

WSTG IDTest NameStatus
WSTG-CLNT-05CSS Injection✅
WSTG-CLNT-06Client-Side Resource Manipulation✅
WSTG-CLNT-07Cross-Origin Resource Sharing✅
WSTG-CLNT-09Clickjacking✅
WSTG-CLNT-10WebSocket Testing✅
WSTG-CLNT-11Web Messaging✅

Tool Categories

CategoryToolsPurpose
CORS TestingCORScanner, curl, custom PoC pagesCORS misconfiguration detection
WebSocketwebsocket-client (Python), Burp WSWebSocket hijacking and injection
Clickjackingcustom HTML iframes, PlaywrightUI redressing PoC construction
Browser AutomationPlaywright, PuppeteerAutomated client-side attack verification
Storage AnalysisBrowser DevTools, custom JSlocalStorage/IndexedDB inspection

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors

Comments

Markdown supported