Extended Clickjacking Detection

Detects advanced clickjacking vulnerabilities including UI redressing via transparent overlays and framebusting bypasses.

zakirkun ebb447a 2 files · 2.1 KB Updated

File contents

Extended Clickjacking Detection

Overview

Beyond basic iframe embedding, clickjacking variants include:

  • Cursorjacking: Replacing the browser cursor to mislead click position
  • Drag-and-drop jacking: Tricking users into dragging content
  • Touchjacking: Exploiting touch events on mobile
  • Framebusting bypass: JavaScript framebusting that can be bypassed via sandbox="allow-scripts"

Remediation

  • Use CSP frame-ancestors 'none' — not bypassable by sandbox attribute
  • Do not rely on JavaScript-only framebusting

zakirkun/ice-tea/tree/main/skills/web/clickjacking-extended commit ebb447ad27

Frequently asked questions

npx skillmds@latest add zakirkun/extended-clickjacking-detection