Loading
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing).
The skill file stays in the publisher's repository.
Paste the copied command in a terminal. It installs this SKILL.md into that agent.
npx skills add elementalsouls/Claude-BugHunter --skill hunt-clickjacking -a cursor -y
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is not a finding.
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is not a finding.
Clickjacking (UI Redressing) lets an attacker load a target page inside a transparent iframe on a malicious site. The victim sees the attacker's decoy UI but clicks the hidden target UI beneath it. No JavaScript on the target is required.
Highest-value targets:
Two mechanisms prevent framing:
X-Frame-Options: DENY # strongest — blocks all framing
X-Frame-Options: SAMEORIGIN # allows same-origin frames only
Content-Security-Policy: frame-ancestors 'none' # CSP equivalent of DENY
Content-Security-Policy: frame-ancestors 'self' # CSP equivalent of SAMEORIGIN
If NEITHER is present, the page is frameable from any origin.
Header-absence is the trigger for investigation, not the finding. Two steps:
Step 1 — Header check (screening). Fetch the target page and inspect the response headers:
curl -sI https://target.example/account/transfer | grep -iE 'x-frame-options|content-security-policy'
If BOTH X-Frame-Options and CSP frame-ancestors are absent, the page is a candidate. If either is present and restrictive (DENY/SAMEORIGIN/frame-ancestors 'none'|'self'), stop — it's protected.
Step 2 — Prove it actually frames and clicks (required for a real finding). Build a minimal PoC and load it in a real browser:
<!doctype html>
<h1>Win a prize — click below</h1>
<iframe src="https://target.example/account/transfer"
style="opacity:0.1;position:absolute;top:0;left:0;width:1000px;height:800px"></iframe>
Confirm ALL of the following, or it is not exploitable:
if(top!==self) breakout, or a Sec-Fetch-Dest/JS frame check).SameSite=Lax or SameSite=Strict (the modern default), the cookie is not sent on the cross-site framed request, and the clickjack fails. Verify the victim's authenticated state carries into the frame.Strategy: target the most sensitive action pages first — severity scales directly with what the victim is tricked into doing.
A valid clickjacking report shows: (1) the target page rendered inside an attacker-controlled iframe in a real browser, (2) a sensitive state-changing action reachable by a framed click while the victim is authenticated (cookies survive the cross-site context), and (3) a screenshot/recording of the overlay. Reporting missing headers with no working frame PoC is a documentation-quality issue, not a vulnerability.