client-side attacks