hunt-clickjacking
针对高价值登录/转账页面的实用检测流程
可被用于攻击测试或钓鱼，需合法授权
检测页面缺失 X-Frame-Options/CSP 而导致的 clickjacking 漏洞
检测页面能不能被别人嵌到无形的 iframe 里，从而诱导用户点到看不见的按钮（UI redressing）。排查登录、转账、账号设置、OAuth 确认页等高价值页面时用，要实测能在真实浏览器里被 framing 并且敏感操作在跨站上下文仍然生效。重点看 X-Frame-Options / CSP frame-ancestors、SameSite 和页面自我 framebusting 是否有效。
▸ 展开 SKILL.md 英文原文
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is not a finding.
帮我安装这个 skill：https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-clickjacking/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/elementalsouls/Claude-BugHunter/main/skills/hunt-clickjacking/SKILL.md"## What is Clickjacking Clickjacking (UI Redressing) lets an attacker load a target page inside a transparent iframe on a malicious site. The victim sees the attacker's decoy UI but clicks the hidden target UI beneath it. No JavaScript on the target is required. **Highest-value targets:** - Login / authentication pages — force login with attacker credentials - Money transfer / checkout / "confirm payment" buttons - Account settings (email change, password change, 2FA disable) - OAuth / social-login "Authorize app" confirmation dialogs - Admin actions (delete, promote user, change role) ## Protection Headers Two mechanisms prevent framing: ``` X-Frame-Options: DENY # stronge