skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

clickjacking

Assess X-Frame-Options and CSP frame-ancestors to detect clickjacking vulnerabilities.

241|28|Updated May 20, 2026
Search Tags:#security testing#clickjacking#x-frame-options#pentest playbook#ui redress#csp frame-ancestors#iframe bypass
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill clickjacking-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: clickjacking
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/clickjacking
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill clickjacking-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Clickjacking playbooks help you determine whether a target page can be embedded and manipulated via transparent iframes so that victims click unintended UI actions.

Core Features & Use Cases

  • Frameability checks: Evaluate X-Frame-Options and Content-Security-Policy frame-ancestors to determine whether framing is allowed.
  • Practical PoC patterns: Generate single-click and multi-step clickjacking templates for sensitive actions (including confirmation flows).
  • Bypass and escalation guidance: Cover common frame-busting behaviors, sandbox-based bypass ideas, browser quirks around ALLOW-FROM, and chaining strategies.
  • Target prioritization: Focus testing on high-impact surfaces such as admin actions, account deletion, password changes, and OAuth consent.

Quick Start

Ask the AI to review the target’s X-Frame-Options and CSP frame-ancestors headers, then produce a clickjacking PoC plan for sensitive endpoints and propose the most relevant remediations.

Frequently Asked Questions about clickjacking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for clickjacking vulnerabilities on a web page?▼

To test for clickjacking, evaluate the target page's X-Frame-Options and CSP frame-ancestors headers to determine framing permissions, then construct iframe-based proof-of-concept templates to verify transparent overlay attacks on sensitive UI actions.

What is a UI redress attack and how does iframe embedding enable it?▼

A UI redress attack embeds a target web page in a transparent iframe so victims interact with hidden or disguised interface elements. Attackers manipulate visual layers to trigger unintended actions like account deletion or password changes.

How can I bypass X-Frame-Options and CSP frame-ancestors protections?▼

Bypassing X-Frame-Options and CSP frame-ancestors involves analyzing frame-busting behaviors, exploiting browser quirks around ALLOW-FROM, leveraging sandbox attributes, and chaining strategies to circumvent incomplete or misconfigured framing restrictions on sensitive endpoints.

Which web endpoints should I prioritize for clickjacking penetration testing?▼

Prioritize high-impact surfaces for clickjacking testing such as admin actions, account deletion workflows, password change forms, and OAuth consent screens where transparent iframe overlays could trigger critical unintended user actions.

Does X-Frame-Options still work or should I use CSP frame-ancestors for clickjacking defense?▼

X-Frame-Options provides legacy clickjacking defense but lacks flexibility, while CSP frame-ancestors offers modern granular control over framing permissions. Validating both headers is essential since inconsistent configurations create bypass opportunities.

Why is my clickjacking PoC not working despite missing frame-busting headers?▼

Clickjacking PoC failures often stem from untested browser quirks around ALLOW-FROM, active frame-busting JavaScript, or sandbox restrictions. Review multi-step confirmation flows and adjust iframe sandbox attributes to replicate transparent overlay conditions.

Related Skills

Explore More Legal & Compliance Skills→
xalgordxalgord
846

clickjacking

Inspect X-Frame-Options and CSP frame-ancestors headers to detect clickjacking vulnerabilities.

Community
Advanced
dreadnodedreadnode
11

doubleclickjacking

Bypass clickjacking protections using double-click timing without iframes.

Official
Intermediate
salmanabdurrahmansalmanabdurrahman

enum-cors-csp

Enumerate and classify CORS policies and CSP directives across web endpoints.

Community
Advanced
limit5limit5

SKILL_HD_CVE_IMPACT

Map CVE entries to affected components in a Software Bill of Materials.

Community
Intermediate