hunt-clickjacking

1## What is Clickjacking
2 
3Clickjacking (UI Redressing) lets an attacker load a target page inside a transparent iframe on a malicious site. The victim sees the attacker's decoy UI but clicks the hidden target UI beneath it. No JavaScript on the target is required.
4 
5**Highest-value targets:**
6- Login / authentication pages — force login with attacker credentials
7- Money transfer / checkout / "confirm payment" buttons
8- Account settings (email change, password change, 2FA disable)
9- OAuth / social-login "Authorize app" confirmation dialogs
10- Admin actions (delete, promote user, change role)
11 
12## Protection Headers
13 
14Two mechanisms prevent framing:
15 
16```
17X-Frame-Options: DENY              # strongest — blocks all framing
18X-Frame-Options: SAMEORIGIN        # allows same-origin frames only
19Content-Security-Policy: frame-ancestors 'none'     # CSP equivalent of DENY
20Content-Security-Policy: frame-ancestors 'self'     # CSP equivalent of SAMEORIGIN
21```
22 
23If NEITHER is present, the page is frameable from any origin.
24 
25## How to Test
26 
27Header-absence is the **trigger for investigation, not the finding**. Two steps:
28 
29**Step 1 — Header check (screening).** Fetch the target page and inspect the response headers:
30 
31```
32curl -sI https://target.example/account/transfer | grep -iE 'x-frame-options|content-security-policy'
33```
34…