Clickjacking PoC Generator

Mon, 16 Mar 2026 00:00:00 +0000

What’s clickjacking

Target page gets loaded in an invisible iframe. Overlay it on a decoy page. Victim thinks they’re clicking “Free iPad” but they’re actually clicking “Delete My Account” on the real site underneath.

It’s been around forever and the fix is trivial, which makes it surprising how often it’s still missing.

The fix (and what we’re testing for)

Two headers kill this attack:

X-Frame-Options: DENY

Content-Security-Policy: frame-ancestors 'none'

DENY blocks framing entirely. SAMEORIGIN / frame-ancestors 'self' allows same-origin framing only. If neither header is present, the page can be framed by anyone.

Poc on ioctl

Clickjacking PoC Generator

What’s clickjacking

The fix (and what we’re testing for)