Clickjacking

What Is Broken and Why

Clickjacking (UI redressing) works by embedding a target application inside a transparent or partially-visible iframe on an attacker-controlled page. Victims see decoy UI elements but are actually interacting with the hidden target page underneath. Single-click, single-step actions are the most exploitable (fund transfers, account deletions, permission grants, one-click purchases). The vulnerability exists when a page can be framed, either because framing protection headers are absent or because deployed JavaScript frame-busting code is bypassable.

Key Signals

• Missing X-Frame-Options header (DENY or SAMEORIGIN)
• Missing Content-Security-Policy: frame-ancestors 'none' or frame-ancestors 'self'
• Target page loads successfully in a test iframe
• Frame-busting JavaScript present (top.location === self.location) but bypassable
• State-changing one-click actions (confirm, approve, authorize, delete) on authenticated pages
• Browser developer tools: Network tab shows page loaded as iframe sub-resource