Detect web page frameability by inspecting X-Frame-Options and CSP frame-ancestors headers.
npx skills add https://github.com/Yliken/ai4 --skill clickjacking-yliken
Please help me install this Agent Skill. Skill: clickjacking Source: https://github.com/Yliken/ai4/tree/main/skills/clickjacking Command: npx skills add https://github.com/Yliken/ai4 --skill clickjacking-yliken
Clickjacking exploits UI redress to perform unintended actions by loading a target page in a transparent iframe and overlaying attacker UI, enabling abuse of sensitive actions.
Run a quick frameability test against a target page by embedding it in a transparent iframe on a test page and observe whether it loads, then evaluate X-Frame-Options and CSP frame-ancestors headers.
High-intent search queries and answers about installing and using this skill.
To test for clickjacking, embed the target web page in a transparent iframe on a test page and observe whether it loads, then evaluate the X-Frame-Options and CSP frame-ancestors headers to determine frameability.
X-Frame-Options and CSP frame-ancestors are HTTP response headers that prevent UI redress attacks by restricting cross-origin framing, with frame-ancestors offering more granular control over which domains can embed a page.
You can create a multi-step clickjacking proof of concept using provided HTML, CSS, and JS PoC templates that overlay attacker UI on a transparent iframe to demonstrate sensitive actions triggered without user intent.
Yes, bypass techniques such as exploiting the iframe sandbox attribute, evading frame-busting scripts, and using double-framing can be applied to understand potential attack surfaces and document bypass possibilities.
Yes, the security testing workflow covers multi-step clickjacking demonstrations across different authentication states to accurately assess the risk of UI actions being triggered without user intent.
A target page might still load if X-Frame-Options is misconfigured, bypassed via double-framing, or if the newer CSP frame-ancestors directive is absent, leaving cross-origin framing vulnerabilities exposed.
hoanghn61Identify web technologies by analyzing HTTP headers, cookies, and error pages.
igbuendAnalyze Content-Security-Policy headers for misconfigurations and bypass risks.
salmanabdurrahmanAudit X-Frame-Options and CSP frame-ancestors headers to verify clickjacking protection.
zebbernAutomate red-team reconnaissance and vulnerability discovery workflows.
