Cybersecurity
Hunt Clickjacking
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is not a finding.
- Publisher / source
- elementalsouls/Claude-BugHunter (found on GitHub top repositories)
- Upstream record
- elementalsouls/Claude-BugHunter
- Version
- Version 1
- Published
- Publication review
- Approved for publication · recorded passed scan 2026-11-05
- Content fingerprint
4d47fdcec28fcce2e01ec9c3097cd7d1d2eda21d212ad13a2ceff770370cd939