> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Clickjacking
> Clickjacking attacks: iframe overlay exploitation, X-Frame-Options, frame-ancestors, and PoC generation.
## Overview
Attacker overlays transparent iframe of target site over a decoy page. Victim clicks what they think is the decoy but actually interacts with the hidden target — changing settings, transferring funds, etc.
***
## Detection
### Check Headers
```bash theme={"dark"}
curl -s -I https://TARGET | grep -iE "x-frame-options|content-security-policy"
```
### Vulnerable If
* No `X-Frame-Options` header
* No `frame-ancestors` in CSP
* `X-Frame-Options: ALLOW-FROM` (deprecated, not supported in modern browsers)
***
## X-Frame-Options
| Value | Description |
| ---------------- | -------------------------------------------------------------- |
| `DENY` | Cannot be framed by anyone |
| `SAMEORIGIN` | Only same origin can frame |
| `ALLOW-FROM uri` | Deprecated — non-functional in modern browsers. Fails silently |
Best practice: use **both** `X-Frame-Options: DENY` and `frame-ancestors 'none'` for backward compatibility.
***
## CSP frame-ancestors (Modern)
```
Content-Security-Policy: frame-ancestors 'none' # Same as DENY
Content-Security-Policy: frame-ancestors 'self' # Same as SAMEORIGIN
Content-Security-Policy: frame-ancestors https://trusted.com
```
`frame-ancestors` overrides `X-Frame-Options` when both present.
***
## Basic PoC
```html theme={"dark"}
Clickjacking PoC
Click the button to win a prize!
```
### Visible for Testing (opacity: 0.5)
```html theme={"dark"}
```
***
## Advanced Techniques
### Drag-and-Drop Clickjacking
Trick user into dragging content from target iframe into attacker-controlled area:
```html theme={"dark"}
Drop here to continue
```
### Multi-Step Clickjacking
Move iframe between clicks to chain multiple actions:
```html theme={"dark"}
```
### Cursorjacking
Replace cursor with offset image — user clicks different position than expected:
```html theme={"dark"}
```
***
## Common Targets
| Action | Impact |
| ----------------------------- | ----------------- |
| Change email/password | Account takeover |
| Enable 2FA on attacker device | Persistent access |
| Delete account | Destructive |
| Transfer funds | Financial |
| Change privacy settings | Data exposure |
| OAuth authorize | Token theft |
| Admin actions | Privilege abuse |
***
## Additional Defenses
### SameSite Cookies
`SameSite=Strict` or `Lax` session cookies are **not sent in any framed (iframe) request** regardless of method (GET or POST), since iframe loads are subresource requests — so they block clickjacking of authenticated actions. The real limitation: no protection when the targeted action doesn't require the session cookie (or when tokens live in localStorage/sessionStorage).
### JavaScript Frame-Busting (Unreliable)
```html theme={"dark"}
```
Bypassed by `sandbox` attribute on iframe. Not a reliable defense.
***
## Automation
### Nuclei
```bash theme={"dark"}
nuclei -t http/misconfiguration/clickjacking/ -l urls.txt
```
### One-Liner Check
```bash theme={"dark"}
while read url; do
headers=$(curl -s -I "$url" 2>/dev/null)
xfo=$(echo "$headers" | grep -ci "x-frame-options")
csp=$(echo "$headers" | grep -ci "frame-ancestors")
if [ "$xfo" -eq 0 ] && [ "$csp" -eq 0 ]; then
echo "[VULN] $url"
fi
done < urls.txt
```
***
## Quick Reference
| Protection | Header |
| ----------------- | ---------------------------------------- |
| Block all framing | `X-Frame-Options: DENY` |
| Same origin only | `X-Frame-Options: SAMEORIGIN` |
| CSP (modern) | `frame-ancestors 'none'` or `'self'` |
| PoC test | iframe with `opacity: 0.0001` over decoy |
***
## Sources
* [OWASP — Clickjacking Defense Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)
* [MDN — X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)
* [PortSwigger — Clickjacking](https://portswigger.net/web-security/clickjacking)