Performing Clickjacking Attack Test

When to Use

• During authorized penetration tests when assessing UI redressing vulnerabilities
• When testing whether sensitive actions (delete account, transfer funds, change settings) can be performed via clickjacking
• For evaluating the effectiveness of X-Frame-Options and Content-Security-Policy frame-ancestors directives
• When assessing applications that process one-click actions without additional confirmation
• During security audits of applications handling financial transactions or account management

Prerequisites

• Authorization: Written penetration testing agreement for the target
• Web browser: Modern browser for testing iframe embedding
• Local web server: Python http.server or similar for hosting PoC pages
• Burp Suite: For examining response headers
• HTML/CSS knowledge: For crafting clickjacking overlay pages
• curl: For checking framing headers on target pages