OSCP · Module 8
Client-Side Attacks
Attack users instead of servers. Browser-based attacks like clickjacking and CSRF, plus payload delivery through Office macros and Windows shortcut files.
~0.75 h 3 resources Last updated September 25, 2026
lient-side attacks target users rather than servers. Instead of exploiting a service directly, you deliver a payload that executes when a user opens a file, clicks a link, or visits a page. PEN-200 covers Microsoft Office macros, Windows library and shortcut files, and browser-based attacks like clickjacking and cross-site request forgery. Success depends on understanding the target's software stack and crafting convincing delivery.
Browser-Based Attacks
Clickjacking tricks users into clicking hidden elements. CSRF forces authenticated actions without the user's knowledge. Both exploit trust between the browser and the target application, and both bypass server-side controls by acting through the victim's session.
Warning
PEN-200 also covers Microsoft Office macros, Windows library files (.library-ms), and shortcut files (.lnk) as client-side payload delivery methods. HackIndex does not currently have dedicated pages for these topics. Refer to the official PEN-200 course material for macro development and file-based payload delivery.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.