Clickjacking labs
Clickjacking (UI Redressing)
What is Clickjacking?
Clickjacking tricks the user into clicking on invisible elements of a victim page loaded in a transparent overlaid iframe. It lets you run sensitive actions (change settings, authorize payments, accept permissions) without the victim being aware.
Why practice Clickjacking?
It's one of the easiest bugs to detect (just check two headers), but sensitive pages are often overlooked. When the framed action is critical (delete account, transfer, authorize OAuth), the impact is real and reportable. A good entry point for hunters starting out.
What will you learn with the Clickjacking labs?
You'll learn to audit X-Frame-Options and the CSP frame-ancestors directive, build a PoC with a transparent iframe and overlay, use opacity and positioning to align the victim's click with the target action, and recognize when impact justifies the report versus a simple 'missing header'.
Types of Clickjacking we cover
- Classic UI redressing
An iframe of the victim page with opacity:0 over a decoy. The user's click lands on the real hidden button.
- Likejacking / action confirmation
A single-click action (follow, grant permission, confirm) is framed and camouflaged under an attractive button.
- Drag&drop
The victim is tricked into dragging an element, exfiltrating data from a framed field or filling in a form.
How do you find and exploit Clickjacking?
A practical playbook — from recon to proof of concept.
- 1
Check the anti-frame defenses
See whether the response carries X-Frame-Options or CSP with frame-ancestors. If they're missing or loose, the page is framable.
curl -sI https://target/account/delete | grep -iE 'x-frame-options|frame-ancestors' - 2
Confirm it can be framed
Create an HTML page that loads the victim page in an iframe. If it renders (isn't blocked), keep going.
<iframe src="https://target/account/settings" width=800 height=600></iframe> - 3
Locate a sensitive one-click action
Look for buttons that do something important with a single click while logged in: delete account, authorize app, change email.
'Delete account' button on /account/settings - 4
Overlay and make the iframe invisible
Set the iframe to near-zero opacity over an attractive decoy and align the real button under the decoy's.
<style>iframe{opacity:0.05;position:absolute;top:-200px;left:-50px;z-index:2}</style> - 5
Prove the impact
Record how a click on your decoy triggers the real action on the victim's account. That turns 'missing header' into a bug with impact.
Decoy: 'You won a prize, click here' → triggers Delete account
Loading labs...
View in full catalog →Frequently asked questions
What is Clickjacking?
It's a UI redressing attack where the victim page is loaded in a transparent iframe overlaid on a decoy. The user thinks they're clicking the decoy, but their click lands on a real hidden button that runs a sensitive action.
How is Clickjacking exploited?
You frame the target page with a near-invisible iframe (low opacity) and position it so a critical button (delete account, authorize OAuth) sits right under an attractive decoy element. When the authenticated victim clicks, they run the action unknowingly.
How do you find Clickjacking in bug bounty?
Check whether sensitive pages send X-Frame-Options or CSP frame-ancestors. If not, mount them in an iframe and verify they render. The report has value when you frame a real-impact single-click action, not an informational page.
How do you prevent Clickjacking?
Send Content-Security-Policy with frame-ancestors 'none' (or your domain), reinforce with X-Frame-Options: DENY/SAMEORIGIN, and for critical actions require extra confirmation or re-authentication that can't be automated with one click.
Difference between Clickjacking and CSRF?
CSRF sends a forged request without real user interaction, abusing their cookies. Clickjacking does need the victim to click, but tricks them with an overlaid UI. The defenses also differ: tokens for CSRF, frame-ancestors for Clickjacking.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice Clickjacking in real labs
Every Clickjacking lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime