README.md

JS & Client-Side Resources

JS Analysis

1. JavaScript Analysis for Pentesters
2. JavaScript for Bug Bounty Hunters - Part 1
3. JavaScript for Bug Bounty Hunters - Part 2
4. JavaScript for Bug Bounty Hunters - Part 3
5. JavaScript Code Review Guide for Bug Bounty Hunters
6. Bug Bounty Tips & Tricks - JS Files
7. Find the Treasure Hidden in JavaScript

Writeups

• EventListener XSS Recon (PostMessage Vulnerabilities Practice)
• DOM XSS in Gmail with Chrome's Help
• Google VRP Report
• How I Found DOM XSS on Bing.com (Microsoft Bug Bounty)
• Lessons Learned from Unusual XSS Vulnerabilities
• TikTok Vulnerability Exposing User Activity and Information
• Writeups on Extensions
• CSP Bypass on PortSwigger.net Using Google Script Resources
• Microsoft Teams Stored XSS CSP Bypass
• How to Spot and Exploit PostMessage Vulnerabilities

Challenges

• Public Firing Range (XSS Challenges)
• XSS Challenges on xss-quiz.int21h.jp
• XSS Solutions for xss-quiz.int21h.jp on Tunelko Blog
• XSS Challenges on sudo.co.il
• XSS Challenges alert(1) to win
• XSS Pwnfunction
• XSS intigriti Monthly Challenges

Series

1. Fady Othman | How to analysis and deal with browser and DEV Tools
2. JavaScript Analysis Series on YouTube
3. Browser Security Series on YouTube
   • Part 2
   • Part 3
4. JS Analysis Live Recon Series on Youtube

Blogs

• Beyond XSS Blog (Excellent client-side focus)
• Yousef Samouda's Blog
• J Lajara's Blog (Focus on client-side bugs, especially PostMessage and PostMessage 2)
• Understanding the PostMessage Vulnerabilities and its implications
• Dompurify Bypass v2.0.17
• Dompurify Bypass again

CSP Resources

• Mozilla CSP Guide
• CSP Bypass Techniques and Mitigations
• CSP and Bypasses
• CSP Bypass Guidelines
• CSP Bypass Search

Prototype Pollution

• Portswigger
• Imperva | Prototype Pollution
• Prototype Pollution — A Deeper Inspection | Amit Nigam

Internals

1. IFrame and cross-domain security

Learning Resources

1. The Tangled Web Book (Mandatory)
2. The Browser Hacker’s Handbook (Optional)
3. Learn BOM and DOM from Elzero:
   • BOM Tutorial
   • DOM Tutorial
4. Cross-window communication

Dev Tools

• Debugger

Important Concepts to Know

You should be familiar with client-side bugs including XSS, PostMessage, WebSocket, CSP, CORS, CSRF, SOP, JSONP, and Prototype Pollution.