domains / families / security / clickjacking

clickjacking

separate

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.

When to use

• testing whether target pages can be framed
• checking X-Frame-Options configuration
• checking CSP frame-ancestors configuration
• testing UI redress attacks
• triggering sensitive actions via clickjacking
• bypassing frame-busting scripts
• multi-step clickjacking
• drag-and-drop attacks

Skill page

Source