Client-Side VAT Test Suite - 20 Vulnerabilities

1

DOM-based XSS

Injection

User input directly inserted into DOM without sanitization

2

Reflected XSS

Injection

URL parameters reflected in page without encoding

3

Client-side SQL Injection

Injection

SQL queries constructed with user input in JavaScript

4

eval() Code Injection

Code Execution

User input passed directly to eval() function

5

innerHTML Injection

DOM Manipulation

Unsanitized content inserted via innerHTML property

6

document.write() Injection

Legacy DOM

Legacy document.write() with unsanitized input

7

Insecure localStorage

Data Storage

Sensitive data stored in browser localStorage without encryption

8

Insecure sessionStorage

Data Storage

Session data stored without proper protection mechanisms

9

Insecure Cookies

Session Management

Cookies without HttpOnly, Secure, or SameSite attributes

10

Clickjacking Vulnerability

UI Redress

Page can be embedded in iframe - no X-Frame-Options header

Click here to test clickjacking

11

Open Redirect (Client)

URL Manipulation

Client-side redirects without URL validation

12

CSRF Token Bypass

Authentication

Forms without CSRF protection tokens

13

Weak Random Generation

Cryptography

Using Math.random() for security-sensitive operations

14

Insecure Crypto (Base64)

Cryptography

Using Base64 encoding as encryption for sensitive data

15

Information Disclosure

Data Exposure

Exposing sensitive system and user information

16

Prototype Pollution

Object Manipulation

Unsafe object manipulation allowing prototype pollution

17

postMessage Vulnerabilities

Cross-Frame Comm

Unsafe cross-frame communication without origin validation

18

Insecure JSON Parsing

Deserialization

Parsing untrusted JSON without validation

19

Client-Side Path Traversal

File Access

Unsafe file path construction in client-side code

20

Unsafe Dynamic Loading

Code Injection

Dynamically loading scripts from user-controlled sources

🛡️ Client-Side VAT Test Suite

Vulnerability Statistics