transilienceai/communitytools

client-side

Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

查看源码

仓库原始内容

按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。

Client-Side

Test for client-side vulnerabilities across modern web applications and SPAs.

Techniques

Type	Key Vectors
XSS	Reflected, Stored, DOM-based, framework-specific (React, Vue, Angular)
CSRF	Token bypass, SameSite cookie bypass, cross-origin requests
CORS	Misconfigured origins, null origin, wildcard credentials
Clickjacking	Frame-based, drag-and-drop, multi-step
DOM-based	DOM sinks, source/sink analysis, JavaScript URL schemes
Prototype Pollution	Client-side gadgets, server-side pollution, property injection

Workflow

Identify input sources and data flows
Classify sink contexts (HTML, attribute, URL, JS, CSS)
Enumerate defenses (encoding, CSP, sanitizers, Trusted Types)
Craft context-appropriate payloads
Validate execution and demonstrate impact
Document with reproduction steps and remediation

Reference

reference/xss*.md - XSS bypass techniques and exploitation
reference/csrf*.md - CSRF techniques and bypasses
reference/cors*.md - CORS misconfiguration testing
reference/clickjacking*.md - Clickjacking techniques
reference/dom*.md - DOM-based vulnerability testing
reference/prototype-pollution*.md - Prototype pollution techniques

来自同一仓库

attack-path-stitcher

Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

安装量: 5
GitHub Stars: 534
最近更新: 7月29日

authenticated-session-acquisition

Acquire an authenticated session THROUGH MFA/OTP on an in-scope target and emit a reusable session artifact (Playwright storageState + Bearer) so executors can test the post-auth attack surface. Use when the highest-value authenticated classes (BOLA/IDOR/mass-assignment/injection on the real data APIs) are blocked because login is gated by SMS-OTP or TOTP MFA. Distinct from the authentication skill (which ATTACKS auth); this one legitimately authenticates and hands the session to the rest of the engagement.

安装量: 1
GitHub Stars: 534
最近更新: 7月29日

blockchain-security

Smart contract security testing and blockchain CTF exploitation. Covers Solidity vulnerability analysis, EVM storage manipulation, delegatecall attacks, CREATE/CREATE2 address prediction, and common DeFi exploit patterns. Use when analyzing Solidity contracts, solving blockchain challenges, or testing smart contract security.

安装量: 1
GitHub Stars: 534
最近更新: 7月29日