clickjacking

Name: clickjacking
Availability: InStock
Author: ok-helloworld

Assess X-Frame-Options and CSP frame-ancestors to detect clickjacking vulnerabilities.

241|28|Updated May 20, 2026

Search Tags:#security testing #clickjacking #x-frame-options #pentest playbook #ui redress #csp frame-ancestors #iframe bypass

Ready to run

npx skills add https://github.com/ok-helloworld/vibe-pentest --skill clickjacking-ok-helloworld

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: clickjacking
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/clickjacking
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill clickjacking-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Clickjacking playbooks help you determine whether a target page can be embedded and manipulated via transparent iframes so that victims click unintended UI actions.

Core Features & Use Cases

Frameability checks: Evaluate X-Frame-Options and Content-Security-Policy frame-ancestors to determine whether framing is allowed.
Practical PoC patterns: Generate single-click and multi-step clickjacking templates for sensitive actions (including confirmation flows).
Bypass and escalation guidance: Cover common frame-busting behaviors, sandbox-based bypass ideas, browser quirks around ALLOW-FROM, and chaining strategies.
Target prioritization: Focus testing on high-impact surfaces such as admin actions, account deletion, password changes, and OAuth consent.

Quick Start

Ask the AI to review the target’s X-Frame-Options and CSP frame-ancestors headers, then produce a clickjacking PoC plan for sensitive endpoints and propose the most relevant remediations.

Frequently Asked Questions about clickjacking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for clickjacking vulnerabilities on a web page?▼

To test for clickjacking, evaluate the target page's X-Frame-Options and CSP frame-ancestors headers to determine framing permissions, then construct iframe-based proof-of-concept templates to verify transparent overlay attacks on sensitive UI actions.

What is a UI redress attack and how does iframe embedding enable it?▼

A UI redress attack embeds a target web page in a transparent iframe so victims interact with hidden or disguised interface elements. Attackers manipulate visual layers to trigger unintended actions like account deletion or password changes.

How can I bypass X-Frame-Options and CSP frame-ancestors protections?▼

Bypassing X-Frame-Options and CSP frame-ancestors involves analyzing frame-busting behaviors, exploiting browser quirks around ALLOW-FROM, leveraging sandbox attributes, and chaining strategies to circumvent incomplete or misconfigured framing restrictions on sensitive endpoints.

Which web endpoints should I prioritize for clickjacking penetration testing?▼

Prioritize high-impact surfaces for clickjacking testing such as admin actions, account deletion workflows, password change forms, and OAuth consent screens where transparent iframe overlays could trigger critical unintended user actions.

Does X-Frame-Options still work or should I use CSP frame-ancestors for clickjacking defense?▼

X-Frame-Options provides legacy clickjacking defense but lacks flexibility, while CSP frame-ancestors offers modern granular control over framing permissions. Validating both headers is essential since inconsistent configurations create bypass opportunities.

Why is my clickjacking PoC not working despite missing frame-busting headers?▼

Clickjacking PoC failures often stem from untested browser quirks around ALLOW-FROM, active frame-busting JavaScript, or sandbox restrictions. Review multi-step confirmation flows and adjust iframe sandbox attributes to replicate transparent overlay conditions.