Extended Clickjacking Detection

Detects advanced clickjacking vulnerabilities including UI redressing via transparent overlays and framebusting bypasses.

zakirkun Updated

File contents

Extended Clickjacking Detection

Overview

Beyond basic iframe embedding, clickjacking variants include:

  • Cursorjacking: Replacing the browser cursor to mislead click position
  • Drag-and-drop jacking: Tricking users into dragging content
  • Touchjacking: Exploiting touch events on mobile
  • Framebusting bypass: JavaScript framebusting that can be bypassed via sandbox="allow-scripts"

Remediation

  • Use CSP frame-ancestors 'none' — not bypassable by sandbox attribute
  • Do not rely on JavaScript-only framebusting

zakirkun/ice-tea/tree/main/skills/web/clickjacking-extended commit ebb447ad27

Frequently asked questions

npx skillmds@latest add zakirkun/extended-clickjacking-detection