Clickjacking
UI Redressing
0 / 4 solved
Test whether sensitive interfaces can be framed and visually disguised by another site.
Quick reference
Clickjacking cheat sheet
Check whether sensitive pages can be framed, then think about what a user could be tricked into clicking without seeing the real interface.
Where to look
- Account settings, OAuth consent, payment/confirmation pages, admin actions, delete/revoke buttons, and any one-click sensitive workflow.
- Inspect response headers for Content-Security-Policy frame-ancestors and X-Frame-Options.
- Try embedding the page in a simple iframe from a different site you control in the lab.
Simple checks
- If the page loads inside an iframe, reduce iframe opacity and see whether a visible lure can be aligned over a real control.
- Test whether the sensitive action needs only one ordinary click.
<iframe src='https://target.example/account'></iframe>Content-Security-Policy: frame-ancestors 'none'X-Frame-Options: DENYRealistic tips
- Do not treat every frameable page as high severity; impact depends on what the user can be induced to do.
- OAuth consent and privileged admin confirmation screens deserve special attention.
- Frame-busting JavaScript is weaker than browser-enforced frame-ancestors/X-Frame-Options.