What problem does it solve? Web pages that lack framing protections can be embedded in invisible iframes, letting attackers trick victims into clicking hidden buttons on sensitive pages. This Skill guides security testers through screening for missing headers and, critically, proving real exploitability in a browser rather than reporting header absence alone. ## Core Features & Use Cases - Header Screening: Fetch target pages and check for X-Frame-Options and CSP frame-ancestors to identify frameable candidates. - Browser-Based Proof of Concept: Build a minimal HTML iframe PoC and confirm the page renders framed, the victim's authenticated session survives the cross-site context, and a state-changing action is reachable. - False Positive Filtering: Distinguish real findings from non-issues caused by SameSite cookies, framebusting JavaScript, or read-only pages. - Use Case: During a bug bounty engagement, test a target's money transfer page by checking its response headers, then loading it in a hidden iframe PoC to demonstrate that an authenticated victim could be tricked into confirming a transfer. ## Quick Start Test https://target.example/account/transfer for clickjacking by checking its framing headers and proving exploitability with a browser-based iframe PoC.
