| name | clickjacking-frame-busting |
| description | Defense-first clickjacking and frame-busting controls: X-Frame-Options, CSP frame-ancestors, SameSite cookie interaction, and authorized UI-redress validation. Use when hardening framable UI, reviewing anti-framing headers, replacing client-side frame-busters, or verifying framing defenses on owned or in-scope apps — not for general XSS or unauthenticated mass framing. |
Clickjacking Defenses And Frame-Busting
Harden pages against UI redress by enforcing who may embed the document,
documenting cookie attachment in frames, and proving residual risk only
with authorized, self-account checks. Primary controls are server headers;
client-side “frame-buster” scripts are not sufficient alone.
When To Use
- Missing, weak, or conflicting
X-Frame-Options (XFO) and CSP frame-ancestors.
- Replacing or auditing
if (top !== self) / top.location frame-buster JS.
- Sensitive UI (settings, delete, OAuth approve, payments confirm) must not load
in untrusted iframes; defense review or post-fix retest is required.
- SameSite / third-party cookie policy may block classic jacking — need residual
risk notes without claiming universal immunity.
- Edge/CDN/app disagree on framing headers (path, host, 200 vs error vs redirect).
Do not use as primary for:
| Need | Skill instead |
|---|
| Full attack PoC / multi-step UI redress | clickjacking, clickjacking-ui-redress-deep |
| Script injection / DOM XSS | xss-cross-site-scripting, injection-checking |
| CSP script-src bypass research | content-security-policy-bypass |
| Cross-site state change without framing | csrf-cross-site-request-forgery |
| Cookie flag audit (broader than framing) | cookie-security-flags |
| nginx edge header delivery only | nginx-security-headers |
Workflow
-
Inventory sensitive documents
List authenticated HTML (or SPA shells) where one click or short sequence
changes state. Note URL, host variants (www / mobile), and whether the
control lives on the initial document or a later client-routed view.
-
Measure framing policy on the UI document
Inspect response headers for every sensitive path (and 3xx/4xx if users can
land there). Prefer evidence from the document that paints the control.
| Control | Strong | Weak / avoid |
|---|
CSP frame-ancestors | 'none' or explicit origin allowlist | Missing, *, bare https: |
X-Frame-Options | DENY or SAMEORIGIN | Absent; obsolete ALLOW-FROM |
| Both present | Modern browsers honor CSP when both set | Relying on XFO alone |
| Delivery | Header on HTML document (and errors if needed) | Only on JSON/API or CDN static assets |
Prefer frame-ancestors as primary; keep XFO as defense-in-depth for
older clients. Values must match product needs (e.g. trusted admin embedders).
-
Authorized framing smoke test
From an approved attacker-origin page or local PoC host, load a minimal
iframe of each candidate URL. Record: loads vs blocked, console XFO/CSP
errors, path/host differences. Do not drive-by real users.
<iframe src="https://target.example/settings/danger" width="800" height="600"></iframe>
-
SameSite and session attachment (not a substitute for frame block)
SameSite=Lax / Strict: cross-site iframes often lack session cookies in
modern Chromium → classic authenticated jack may fail; document profile.
Routing
| Need | Skill |
|---|
| Defense headers, frame-buster replacement, framing retest | This skill |
| Baseline or advanced UI-redress PoC | clickjacking, clickjacking-ui-redress-deep |
| CSRF without framing | csrf-cross-site-request-forgery |
| Cookie SameSite/Secure/HttpOnly audit | cookie-security-flags |
| OAuth consent framed as protocol issue | oauth-oidc-misconfiguration |
| XSS / script-src CSP | xss-cross-site-scripting, content-security-policy-bypass |
| Edge header delivery (nginx) | nginx-security-headers |
| Safe config/app change practice | code-quality-standards |
Output Checklist
Scope And Authorization
- In scope: owned apps, labs, CTFs, and written engagements that allow framing
and header review. Prefer test accounts and self-impact actions.
- Out of scope: drive-by framing of real users; irreversible money movement or
mass admin actions without explicit approval; treating this skill as general XSS.
- Host PoC HTML only on approved exploit servers or local files under program rules.
- Redact session cookies, tokens, and PII from screenshots and reports.
- Missing headers alone are incomplete without a sensitive framable control
or a clear defense-gap finding on high-value UI under engagement rules.
- Evidence over assumptions: record effective browser behavior; do not claim all
modern browsers are immune because of SameSite defaults alone.
