Supreme Clickjacking Vulnerability

[1.165]

Steps To Reproduce:

1. Create a new HTML file
   
2. Put https://pastebin.com/9XZVfjKR
   
3. Save the file
   
4. Open document in browser
   

Impact
An attacker may trick user, sending them a malicious link 

Solution
The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP (Content-Security-Policy) header.

@J_S

 

 

+REP APPRECIATES MY WORK
BEWARE OF IMPERSONATORS.
  ALWAYS CONFIRM ON C.TO BEFORE ANY DEAL.

[1.846]

Adding "frame-ancestors 'self';"  header just breaks the page.

For sale - signature spots | Top spot - 65$ | mid - 45$ | bottom - 30$

Top ad by @80s [exp 07/01/25]

mid ad by @Brox [exp 09/01/25]

bottom ad by @Rose [exp 11/01/25]

[1.165]

Adding "frame-ancestors 'self';"  header just breaks the page.

I Dont know what is the reason behind it but you can check this below website 

https://cheatsheetseries.owasp.org/cheat...Sheet.html

 

 

+REP APPRECIATES MY WORK
BEWARE OF IMPERSONATORS.
  ALWAYS CONFIRM ON C.TO BEFORE ANY DEAL.

[4.054]

Steps To Reproduce:

1. Create a new HTML file
   
2. Put https://pastebin.com/9XZVfjKR
   
3. Save the file
   
4. Open document in browser
   

Impact
An attacker may trick user, sending them a malicious link 

Solution
The vulnerability can be fixed by adding "frame-ancestors 'self';" to the CSP (Content-Security-Policy) header.

@J_S

+
X-Frame options in the header needs to be added to prevent this
1. put it on DENY to disallow c.to being iframed on any other domain
2. but use sameorigin to allow c.to to be iframed within same domain , i mean inside of c.to domain it can be iframe (cuz only adding DENY from option1 will restrict it being iframed anywhere including c.to own domain)
so both of those headers to be used

Ad by firewizard 

[1.165]

Adding "frame-ancestors 'self';"  header just breaks the page.

it means maybe you are using content from some external source and after adding *frame-ancestors 'self';* .. the content is prohibited from being displayed within the page due to CSP.

X-FRAME-OPTIONS: SAMEORIGIN

Or

X-FRAME-OPTIONS: DENY

May work

 

 

+REP APPRECIATES MY WORK
BEWARE OF IMPERSONATORS.
  ALWAYS CONFIRM ON C.TO BEFORE ANY DEAL.

[85]

This is not a clickjacking vuln, Burp Suite will say there is a clickjacking vuln in (almost) every secure site you visit.
Trust me when I say this, Burp Suite vuln crawler is bad xD
@J_S this is not something you need to worry about