Web - Client

Browser-side attacks: XSS, DOM sinks, CSP, and front-end trust boundaries.

12 results

Root-Me/XSS DOM Based - Introduction·35pts

XSS DOM Based - Introduction — Root-Me

Web client notes for XSS DOM Based - Introduction: XSS variants, CSP bypass narratives, and chaining a UI flaw with an API call the server should have rejected..

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/CSRF 0 protection·35pts

CSRF 0 protection — Root-Me

Client-side web challenge CSRF 0 protection.

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/CSP Bypass - Inline code·35pts

CSP Bypass - Inline code — Root-Me

For CSP Bypass - Inline code, the attack surface lives in front-end validation.

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/AST - Deobfuscation·35pts

AST - Deobfuscation — Root-Me

Client-side web challenge AST - Deobfuscation.

Webinsane#web #root-me #insaneMay 26, 2026

Root-Me/XSS - Stored 1·30pts

XSS - Stored 1 — Root-Me

Web client notes for XSS - Stored 1: XSS variants, CSP bypass narratives, and chaining a UI flaw with an API call the server should have rejected..

Webhard#web #root-me #hardMay 26, 2026

Root-Me/Javascript - Obfuscation 3·30pts

Javascript - Obfuscation 3 — Root-Me

Client-side web challenge Javascript - Obfuscation 3.

Webhard#web #root-me #hardMay 26, 2026

Root-Me/Javascript - Webpack·15pts

Javascript - Webpack — Root-Me

For Javascript - Webpack, the attack surface lives in front-end validation.

Webmedium#web #root-me #mediumMay 26, 2026

Root-Me/Javascript - Obfuscation 1·10pts

Javascript - Obfuscation 1 — Root-Me

For Javascript - Obfuscation 1, the attack surface lives in front-end validation.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/Javascript - Authentication 2·10pts

Javascript - Authentication 2 — Root-Me

Client-side web challenge Javascript - Authentication 2.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/Javascript - Source·5pts

Javascript - Source — Root-Me

Client-side web challenge Javascript - Source.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/Javascript - Authentication·5pts

Javascript - Authentication — Root-Me

Client-side web challenge Javascript - Authentication.

Webeasy#web #root-me #easyMay 26, 2026

Root-Me/HTML - disabled buttons·5pts

HTML - disabled buttons — Root-Me

Client-side web challenge HTML - disabled buttons.

Webeasy#web #root-me #easyMay 26, 2026