clickjacking

Clickjacking Detection

Overview

Clickjacking is an interface attack: the attacker loads a genuine page of the target application inside a nearly invisible frame, positions it above a decoy of their own, and lines up a specific control under something the victim wants to click. The victim clicks the decoy, the click lands on the real application in their own authenticated session, and a real action fires — change the account email, delete the account, approve a payment, grant a permission. Because the request is produced by the authentic page, it carries that page's own anti-forgery token, so token-based defences do not help; the correct control is a response header that refuses framing. The attacker is a remote site the victim is lured to visit while logged in, and the cost is one real interaction — which also caps likelihood, since no click means no attack. Variants extend it: values prefilled from the URL let the attacker decide the outcome in advance, stacked overlays walk the victim through multi-step flows, and a framed page carrying a script sink turns one click into code execution. This skill locates every sensitive page together with the framing controls that do or do not cover it, checks each one in parallel, and merges results into <output_dir>/clickjacking-results.md.

What it is NOT

• Cross-site request forgery (/websec:csrf): forgery fabricates a request with no victim interaction and is stopped by a per-session token. Clickjacking needs a real click and defeats tokens because the framed authentic page supplies a valid one. Test: does the attack require the victim to interact with a rendered copy of the real page? Yes is this class, and the fix is a framing header, not a token.
• Cross-site scripting (/websec:xss) and other client-side sinks (/websec:dom-based): framing injects nothing. When a framed page reaches script execution, the injection flaw is the finding and belongs to /websec:xss; record here only that framing supplies the interaction it needs. A sink reached through a URL parameter without framing is not this class at all.
• Broken access control (/websec:access-control): if the action should have been refused for this caller in the first place, the missing check is authorisation. Clickjacking borrows an authority the victim genuinely holds.
• Cross-origin read policy (/websec:cors): sharing headers govern whether script may read a response; framing headers govern whether a document may be embedded. They are separate mechanisms and neither substitutes for the other.
• Content spoofing and embedding-based phishing: framing a purely informational public page so an attacker's site looks legitimate is a presentation and brand issue with no state change behind it. No skill in this set owns it. Test: name the action a victim's click would perform in the framed page; if there is none, it is out of scope — say so and move on rather than reaching for a neighbouring class.
• Not a finding: a page that sends X-Frame-Options: DENY/SAMEORIGIN or a CSP frame-ancestors directive restricting framers to 'none' or 'self' — the browser simply refuses to render it, however sensitive the action; a frameable page with no state-changing single-click control; a page whose sensitive action requires an unpredictable interaction the attacker cannot pre-aim, such as re-authentication, a one-time code, or typing a value only shown on that page; framing deliberately permitted for a named partner origin via an explicit frame-ancestors allowlist that the architecture documents.