hunt-clickjacking
SkillSecurityThis skill checks websites for missing clickjacking protection. Sites without the right safeguards can be embedded in an invisible frame, letting attackers trick visitors into clicking buttons they cannot see. Once added, your AI can test whether sensitive pages like login flows or money transfer screens are exposed this way and report what it finds.
Available today. Use it from your connected AI after setup.
No other account needed.
Add the skill, then give your AI a website or a list of pages to review. It will check the sensitive pages you name and tell you which ones lack clickjacking protection.
Then ask your AI: use the hunt-clickjacking skill
What your AI can do with it
- Check websites for missing clickjacking protection
- Test whether sensitive pages can be embedded in an invisible frame
- Scan login flows, money transfers, account settings, and OAuth confirmation pages
- Confirm findings by fetching the page directly
- Report which pages could be used to trick users into hidden clicks
What this skill tells your AI
The instructions your AI receives, as published by elementalsouls/claude-bughunter in skills/hunt-clickjacking/SKILL.md and read by ahel’s review.
What is Clickjacking
Clickjacking (UI Redressing) lets an attacker load a target page inside a transparent iframe on a malicious site. The victim sees the attacker's decoy UI but clicks the hidden target UI beneath it. No JavaScript on the target is required.
Highest-value targets:
- Login / authentication pages — force login with attacker credentials
- Money transfer / checkout / "confirm payment" buttons
- Account settings (email change, password change, 2FA disable)
- OAuth / social-login "Authorize app" confirmation dialogs
- Admin actions (delete, promote user, change role)
Protection Headers
Two mechanisms prevent framing:
X-Frame-Options: DENY # strongest — blocks all framing
X-Frame-Options: SAMEORIGIN # allows same-origin frames only
Content-Security-Policy: frame-ancestors 'none' # CSP equivalent of DENY
Content-Security-Policy: frame-ancestors 'self' # CSP equivalent of SAMEORIGIN
If NEITHER is present, the page is frameable from any origin.
How to Test
Header-absence is the trigger for investigation, not the finding. Two steps:
Step 1 — Header check (screening). Fetch the target page and inspect the response headers:
curl -sI https://target.example/account/transfer | grep -iE 'x-frame-options|content-security-policy'
If BOTH X-Frame-Options and CSP frame-ancestors are absent, the page is a candidate. If either is present and restrictive (DENY/SAMEORIGIN/frame-ancestors 'none'|'self'), stop — it's protected.
Step 2 — Prove it actually frames and clicks (required for a real finding). Build a minimal PoC and load it in a real browser:
<!doctype html>
<h1>Win a prize — click below</h1>
<iframe src="https://target.example/account/transfer"
style="opacity:0.1;position:absolute;top:0;left:0;width:1000px;height:800px"></iframe>
Confirm ALL of the following, or it is not exploitable:
- The page actually renders inside the iframe (no framebusting JS that blanks/redirects it — e.g.
if(top!==self)breakout, or aSec-Fetch-Dest/JS frame check). - The sensitive action still works while framed — critically, the action must succeed cross-site. If it relies on a session cookie set
SameSite=LaxorSameSite=Strict(the modern default), the cookie is not sent on the cross-site framed request, and the clickjack fails. Verify the victim's authenticated state carries into the frame. - The target is a state-changing action (transfer, settings/email/password change, 2FA disable, OAuth authorize, admin action), not a read-only page.
Strategy: target the most sensitive action pages first — severity scales directly with what the victim is tricked into doing.
False Positives
- Public, read-only pages (home/marketing) lacking frame protection are low/informational — no sensitive action to redress.
- APIs and non-HTML endpoints (JSON, images) are not clickjacking targets.
- Header-absence alone is NOT a finding. SameSite cookies, framebusting JS, or the lack of any sensitive framed action can each fully defeat it — which is why Step 2 is mandatory.
Proof Requirements
A valid clickjacking report shows: (1) the target page rendered inside an attacker-controlled iframe in a real browser, (2) a sensitive state-changing action reachable by a framed click while the victim is authenticated (cookies survive the cross-site context), and (3) a screenshot/recording of the overlay. Reporting missing headers with no working frame PoC is a documentation-quality issue, not a vulnerability.
Signals
- GitHub stars
- 4k
- Forks
- 668
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
hunt-clickjacking- Source
- github.com/elementalsouls/claude-bughunter