Clickjacking & XS-Leaks
Framable pages are inventory. A one-click sensitive action, or a leak of cross-origin state, is the report.
Tags: clickjacking, xs-leak, frame
Level: intermediate
Method
Frame the sensitive page
OAuth consent, disable MFA, delete, transfer. Check XFO and CSP frame-ancestors on that page, not the marketing site.
Build a real overlay
Opacity, pointer positioning, a plausible attacker UI. Programs want a PoC, not a theory.
XS-Leaks
Frame count, timing, error events, cache, navigations, COOP missing. Infer login or search hits.
Field notes
- Most programs will N/A 'homepage is framable'. Pick a dangerous action.
- COOP/COEP changes what XS-Leaks still work. Test the live headers.