skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

clickjacking

Detect clickjacking vulnerabilities by validating framing headers and generating PoC exploits.

96|1|Updated Jun 4, 2026
Search Tags:#clickjacking#csp#web-security#proof-of-concept#penetration-testing#x-frame-options#ui-redress
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill clickjacking-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: clickjacking
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/clickjacking
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill clickjacking-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Clickjacking (UI redress) is a widespread web vulnerability where attackers trick users into clicking hidden, transparent iframes overlaid on legitimate pages, leading to unintended sensitive actions like account deletion, admin privilege changes, or payment confirmations. This Skill eliminates the manual, error-prone process of testing for these flaws, which are often missed by automated scanners due to their reliance on context-aware testing of state-changing endpoints.

Core Features & Use Cases

  • Framing Header Validation: Automatically checks for missing or misconfigured X-Frame-Options and CSP frame-ancestors headers to identify frameable pages.
  • Multi-Scenario PoC Generation: Provides ready-to-use templates for basic single-click, multi-step, and drag-and-drop clickjacking attacks to confirm exploitability.
  • Bypass Technique Library: Includes tested methods to bypass common frame-busting scripts, deprecated ALLOW-FROM directives, and same-origin framing restrictions.
  • Use Case: A security tester auditing a corporate admin panel can use this Skill to quickly identify if the user role modification page is frameable, generate a working proof-of-concept, and test bypasses for any implemented frame protection.

Quick Start

Use the clickjacking skill to test if the target's account deletion page is vulnerable to UI redress attacks and generate a working proof-of-concept if it is.

Frequently Asked Questions about clickjacking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test if a web page is vulnerable to clickjacking attacks?▼

To test for clickjacking vulnerabilities, you validate if sensitive state-changing pages can be embedded in invisible iframes by checking for missing or misconfigured X-Frame-Options and CSP frame-ancestors headers.

What is a UI redress attack and how does it compromise web applications?▼

A UI redress attack tricks users into clicking hidden, transparent iframes overlaid on legitimate pages, leading to unintended actions like account deletion or payment confirmation on unprotected web applications.

How do I generate a proof-of-concept for a clickjacking vulnerability?▼

You can generate a clickjacking proof-of-concept using ready-to-use templates for basic single-click, multi-step, and drag-and-drop attacks to confirm the exploitability of unprotected endpoints.

How can I bypass frame-busting scripts during penetration testing?▼

You can bypass frame-busting scripts during penetration testing by applying tested techniques from a bypass library to circumvent deprecated ALLOW-FROM directives and same-origin framing restrictions.

Does CSP frame-ancestors completely prevent UI redress attacks?▼

While CSP frame-ancestors prevents UI redress attacks by restricting framing, misconfigurations or missing headers leave web applications exploitable, requiring validation of both CSP and X-Frame-Options.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
846

clickjacking

Inspect X-Frame-Options and CSP frame-ancestors headers to detect clickjacking vulnerabilities.

Community
Advanced
anis-marrouchianis-marrouchi

motion-animation

Integrate Framer Motion with Remotion for frame-synced animations.

Community
Intermediate
jayjpatel9717jayjpatel9717

csrf-testing

Scan web applications for CSRF vulnerabilities and test token validation.

Community
Advanced
utsavthakurutsavthakur

clickjacking

Detect and simulate clickjacking attacks by analyzing X-Frame-Options and CSP frame-ancestors headers.

Community
Advanced