Client side vulnerabilities that every hacker should know

The major client-side vulnerability classes that come up constantly in web security work and everyone who start learning web security starts for here so,

Hey let start then:

1. Cross-Site Scripting (XSS)

Attacker-controlled JavaScript executes in a victim's browser in the context of a trusted site.

Reflected XSS — payload comes from the URL/request and is echoed back unsanitized.
Stored XSS — payload gets saved server-side (comments, profiles) and served to other users.
DOM-based XSS — the vulnerability lives entirely in client-side JS (e.g., innerHTML, document.write fed by location.hash), no server round-trip needed.

2. Cross-Site Request Forgery (CSRF)

Tricks a logged-in user's browser into submitting an unwanted request to a site they're authenticated with, exploiting the fact that cookies are sent automatically. Mitigated by CSRF tokens, SameSite cookies.

3. Clickjacking (UI Redressing)

Invisible iframes overlay a legitimate page's buttons so clicks are hijacked. Mitigated with X-Frame-Options / frame-ancestors CSP.

Overly permissive Access-Control-Allow-Origin (especially reflecting Origin + Allow-Credentials: true) lets attacker-controlled pages read sensitive authenticated responses.

5. Open Redirects

Unvalidated redirect parameters used for phishing or to bypass OAuth redirect_uri checks.

6. postMessage / Cross-Window Communication Flaws

Missing origin checks on window.postMessage listeners let any page send/receive messages meant for a trusted origin.

7. Content Security Policy (CSP) Bypass

Weak CSPs (unsafe-inline, wildcard sources, whitelisted JSONP endpoints) that don't actually stop injected scripts from running.

8. Client-Side Template Injection / Prototype Pollution

Frameworks (Angular, Vue) evaluating user input as template expressions; or JS objects being polluted via __proto__ to alter app behavior.

9. Insecure Storage

Sensitive tokens/data stashed in localStorage/sessionStorage, which is readable by any script on the page (worse than cookies with HttpOnly), so XSS becomes full account takeover.

10. Subresource / Supply-Chain Issues

Loading third-party scripts/CDN resources without Subresource Integrity (SRI) — compromise of the third party compromises every site including it.

11. Man-in-the-Browser via Malicious Extensions

Browser extensions with broad permissions can read/modify page content and intercept credentials.

12. WebSocket / Cross-Site WebSocket Hijacking (CSWSH)

WebSocket handshakes that don't validate Origin, allowing cross-origin pages to open authenticated WS connections.

let me know and I can go deeper on relevant defenses, testing methodology, or point you toward practice labs (PortSwigger's Web Security Academy is excellent and free for most of these.

Thankyou for Reading:)

Contents