hunt-clickjacking

## What is Clickjacking Clickjacking (UI Redressing) lets an attacker load a target page inside a transparent iframe on a malicious site. The victim sees the attacker's decoy UI but clicks the hidden target UI beneath it. No JavaScript on the target is required. **Highest-value targets:** - Login / authentication pages — force login with attacker credentials - Money transfer / checkout / "confirm payment" buttons - Account settings (email change, password change, 2FA disable) - OAuth / social-login "Authorize app" confirmation dialogs - Admin actions (delete, promote user, change role) ## Protection Headers Two mechanisms prevent framing: ``` X-Frame-Options: DENY # strongest — blocks all framing X-Frame-Options: SAMEORIGIN # allows same-origin frames only Content-Security-Policy: frame-ancestors 'none' # CSP equivalent of DENY Content-Security-Policy: frame-ancestors 'self' # CSP equivalent of SAMEORIGIN ``` If NEITHER is present, the page is frameable from any origin. ## How to Test Header-absence is the **trigger for investigation, not the finding**. Two steps: **Step 1 — Header check (screening).** Fetch the target page and inspect the response headers: ``` curl -sI https://target.example/account/transfer | grep -iE 'x-frame-options|content-security-policy' ``` If BOTH `X-Frame-Options` and CSP `frame-ancestors` are absent, the page is a *candidate*. If either is present and restrictive (`DENY`/`SAMEORIGIN`/`frame-ancestors 'none'|'se...