Clickjacking / UI redress
Frame an authenticated sensitive page. Proof is a framed screenshot of a state-changing UI you own, plus missing X-Frame-Options / CSP frame-ancestors.
Tags: clickjacking, xss, csrf
Controlled probes
<iframe src="https://target.example/account/delete"></iframe>Check X-Frame-Options and CSP frame-ancestors on the sensitive route, not just /Do not trick a real user. Frame an account you own.
Source: https://owasp.org/www-community/attacks/Clickjacking