domains / families / security / performing-clickjacking-attack-test

performing-clickjacking-attack-test

separate

Testing web applications for clickjacking vulnerabilities by assessing

When to use

• During authorized penetration tests when assessing UI redressing vulnerabilities
• When testing whether sensitive actions (delete account, transfer funds, change settings) can be performed via clickjacking
• For evaluating the effectiveness of X-Frame-Options and Content-Security-Policy frame-ancestors directives
• When assessing applications that process one-click actions without additional confirmation
• During security audits of applications handling financial transactions or account management

When not to use

• unauthorized use against systems without written permission

Skill page

Source