Clickjacking Hunter

Clickjacking (UI redressing) tricks a victim into clicking elements on a hidden target page by overlaying invisible iframes on top of decoy content. Impact ranges from account deletion and fund transfer to OAuth authorization and 2FA disable — any one-click sensitive action is a candidate.

Phase 1 — Check Framing Protections

1.1 Header check (fast)

curl -sI https://target.com/account/settings | grep -i "x-frame-options\|content-security-policy"

What you're looking for: