skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vuln-clickjacking

Audit X-Frame-Options and CSP frame-ancestors headers to verify clickjacking protection.

Updated Jul 30, 2026
Search Tags:#security#vulnerability#clickjacking#csp#web-security#pentesting
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-clickjacking
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-clickjacking
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-clickjacking
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-clickjacking

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the risk of clickjacking by providing a structured, safe methodology to verify if web applications are vulnerable to UI-redressing attacks without requiring live exploitation or public infrastructure.

Core Features & Use Cases

  • Protection Header Audit: Automatically inspects X-Frame-Options and CSP frame-ancestors headers to determine the security posture of sensitive endpoints.
  • Framing Verification: Facilitates the creation of local HTML test harnesses to confirm if browsers permit framing of sensitive pages.
  • Use Case: A security researcher needs to verify if a banking application's password change page is susceptible to clickjacking; this skill guides them through the audit and PoC construction process safely.

Quick Start

Use the vuln-clickjacking skill to audit the framing protections for the target application and generate a local proof-of-concept for any identified sensitive endpoints.

Frequently Asked Questions about vuln-clickjacking

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for clickjacking vulnerabilities on sensitive web endpoints?▼

To test for clickjacking vulnerabilities, you audit X-Frame-Options and CSP frame-ancestors headers on sensitive endpoints and construct local HTML harnesses to verify if browsers permit framing. This ensures systematic validation of UI-redressing protections without live exploitation.

What is the difference between X-Frame-Options and CSP frame-ancestors for UI-redressing protection?▼

X-Frame-Options and CSP frame-ancestors are HTTP response headers that prevent UI-redressing by controlling framing permissions. Evaluating both ensures compliance with modern browser security standards, as CSP frame-ancestors provides more granular control over allowed framing sources compared to the legacy X-Frame-Options directive.

Can I verify clickjacking risks on OAuth authorization flows without public infrastructure?▼

Yes, you can verify clickjacking risks on OAuth authorization flows without public infrastructure by creating local HTML test harnesses. This structured methodology safely confirms if browsers permit framing of sensitive pages without requiring live exploitation or external hosting.

How do I safely generate a clickjacking proof-of-concept for a banking application?▼

You safely generate a clickjacking proof-of-concept for a banking application by applying a structured methodology to audit framing protections and build a local test harness. This confirms susceptibility of sensitive endpoints like password change pages without live exploitation.

Does CSP frame-ancestors completely prevent clickjacking on legacy browsers?▼

CSP frame-ancestors may not completely prevent clickjacking on legacy browsers that lack modern security standard support. Systematic validation of both X-Frame-Options and CSP frame-ancestors directives is required to ensure comprehensive framing protection across different browser environments.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

recon-breweries

Probe brewery websites for exposed APIs and misconfigured e-commerce platforms.

Community
Intermediate
transilienceaitransilienceai
462

web-application-pentesting

Coordinate web application penetration testing across REST APIs, SPAs, and microservices.

Official
Basic
lucasFR2lucasFR2

laravel-security-audit

Scan Laravel applications for OWASP vulnerabilities and misconfigurations.

Community
Advanced
RifteoRifteo
30

clickjacking-hunter

Detect and bypass clickjacking vulnerabilities by analyzing HTTP headers and generating PoC HTML pages.

Official
Advanced