Agent skill · security · yaklang
clickjacking
Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.
Why this skill is useful
Provides detailed executable scripts and techniques for exploiting clickjacking vulnerabilities that are not commonly known or documented.
What it needs
About 2k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Clickjacking — Expert Attack Playbook AI LOAD INSTRUCTION: Clickjacking (UI redress) techniques. Covers iframe transparency tricks, X-Frame-Options bypass, CSP frame-ancestors, multi-step clickjacking, drag-and-drop attacks, and chaining with other vulnerabilities. Often a "low severity" finding that becomes critical when targeting admin actions. 1. CORE CONCEPT Clickjacking loads a target page in a transparent iframe overlaid on an attacker's page. The victim sees the attacker's UI but clicks on the invisible target page, performing unintended actions. --- 2. DETECTION — IS THE PAGE FRAMEABLE? Check X-Frame-Options Header Check CSP frame-ancestors CSP frame-ancestors supersedes X-Frame-Options in modern browsers. Quick PoC Test If the page loads in the iframe → frameable → potentially vulnerable. JavaScript Frame Detection (from target page source) If this code is present but not using CSP frame-ancestors, it can often be bypassed. --- 3. PROOF OF CONCEPT TEMPLATES Basic Single-Click Multi-Step Clickjacking For actions requiring multiple clicks (e.g., "Are you sure?" confirmation): Reposition iframe for each step to align the transparent button with the decoy. Drag-and-Drop Clickjacking Extract data from one iframe to another using HTML5 drag-and-drop events — the victim drags across invisible iframes, transferring tokens or data. --- 4. BYPASS TECHNIQUES Frame-Busting Script Bypass Some pages use JavaScript frame-busting: Bypass with sandbox attribute: X-Frame-Options ALLOW-FROM Bypass ALLOW-FROM is not supported in Chrome/Safari. If the server relies solely on ALLOW-FROM, modern browsers ignore it → page is frameable. Double-Framing If X-Frame-Options: SAMEORIGIN is set, but a same-origin page exists that can be framed (without XFO), use that page as an intermediary to frame the target. --- 5. HIGH-IMPACT TARGETS --- 6. TESTING CHECKLIST
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/clickjacking