clickjacking

Name: clickjacking
Availability: InStock
Author: yliken

Detect web page frameability by inspecting X-Frame-Options and CSP frame-ancestors headers.

5|1|Updated Apr 20, 2026

Search Tags:#clickjacking #csp #web-security #poc #x-frame-options #frame-ancestors #ui-redress

Ready to run

npx skills add https://github.com/Yliken/ai4 --skill clickjacking-yliken

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: clickjacking
Source: https://github.com/Yliken/ai4/tree/main/skills/clickjacking
Command: npx skills add https://github.com/Yliken/ai4 --skill clickjacking-yliken

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Clickjacking exploits UI redress to perform unintended actions by loading a target page in a transparent iframe and overlaying attacker UI, enabling abuse of sensitive actions.

Core Features & Use Cases

Detect frameability by inspecting X-Frame-Options and CSP frame-ancestors headers.
Provide PoC templates for single-click and multi-step frames.
Document bypass techniques such as sandbox attribute, frame-busting scripts, and double-framing to understand potential attack surfaces.
Apply in security testing scenarios to assess risk of UI actions being triggered without user intent.

Quick Start

Run a quick frameability test against a target page by embedding it in a transparent iframe on a test page and observe whether it loads, then evaluate X-Frame-Options and CSP frame-ancestors headers.

Frequently Asked Questions about clickjacking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test a web page for clickjacking vulnerabilities?▼

To test for clickjacking, embed the target web page in a transparent iframe on a test page and observe whether it loads, then evaluate the X-Frame-Options and CSP frame-ancestors headers to determine frameability.

What is the difference between X-Frame-Options and CSP frame-ancestors for preventing UI redress attacks?▼

X-Frame-Options and CSP frame-ancestors are HTTP response headers that prevent UI redress attacks by restricting cross-origin framing, with frame-ancestors offering more granular control over which domains can embed a page.

How do I create a multi-step clickjacking proof of concept?▼

You can create a multi-step clickjacking proof of concept using provided HTML, CSS, and JS PoC templates that overlay attacker UI on a transparent iframe to demonstrate sensitive actions triggered without user intent.

Can I bypass frame-busting scripts using a sandbox attribute or double-framing?▼

Yes, bypass techniques such as exploiting the iframe sandbox attribute, evading frame-busting scripts, and using double-framing can be applied to understand potential attack surfaces and document bypass possibilities.

Does this clickjacking test workflow assess risk across different authentication states?▼

Yes, the security testing workflow covers multi-step clickjacking demonstrations across different authentication states to accurately assess the risk of UI actions being triggered without user intent.

Why does my target page still load in an iframe despite setting X-Frame-Options?▼

A target page might still load if X-Frame-Options is misconfigured, bypassed via double-framing, or if the newer CSP frame-ancestors directive is absent, leaving cross-origin framing vulnerabilities exposed.