doubleclickjacking

What problem does it solve?

Standard clickjacking protections including X-Frame-Options, CSP frame-ancestors, and SameSite cookies block traditional iframe-based clickjacking attacks, leaving sensitive one-click actions like OAuth authorization, account deletion, and email changes vulnerable to a new double-click timing variant that bypasses all these defenses.

Core Features & Use Cases

• Double-Click Timing Bypass: Exploits the short gap between mousedown and mouseup in a double-click to load a target sensitive action page in a new window, avoiding all framing-based security controls.
• No Iframe Required: Operates without embedding the target application in an iframe, rendering X-Frame-Options and CSP frame-ancestors completely ineffective.
• Use Case: Test the security of OAuth authorization flows, account management endpoints, and permission grant features that lack additional confirmation steps such as modals, re-authentication, or CAPTCHAs.

Quick Start

Use the doubleclickjacking skill to test if a sensitive one-click action on your target web application is vulnerable to double-click timing clickjacking attacks.