If the Page Loads
The target appears to allow this site to frame it. That may indicate anti-clickjacking controls are missing, incomplete, or intentionally permissive.
Clickjacking is a simple attack that attempts to trick a user into interacting with a website through a page they did not intend to use. One basic defense is preventing untrusted websites from embedding your application in a frame.
This tester is a small proof of concept for one of the many security controls we look at during a penetration test. Enter a URL below and see whether the page can be displayed inside another website.
Enter a website address. If the page appears below in the proof-of-concept frame, then the application appears to permit framing by this site. That alone does not establish meaningful exploitability.
No scanning, exploitation, or requests beyond loading the URL in your browser.
Clickjacking is a useful teaching example because the behavior is easy to see. The risk, however, depends on what the framed application allows a user to do.
The target appears to allow this site to frame it. That may indicate anti-clickjacking controls are missing, incomplete, or intentionally permissive.
The site may be blocking framing with browser-enforced protections such as Content Security Policy or X-Frame-Options. Other browser or application behavior can also prevent display.
A frameable marketing page and an authenticated application with sensitive state-changing actions do not present the same risk. Context matters.
Clickjacking is generally a Low-severity finding (unless an attacker can demonstrate meaningful impact). It is also commonly excluded from bug bounty programs when reported without additional exploitability.
That is exactly why we like it as a simple demonstration. Penetration testing is not only about dramatic vulnerabilities. It also validates the smaller security controls that are easy to overlook and determines whether they matter in the context of the application.
Modern applications typically control framing through the Content Security Policy (CSP) frame-ancestors directive. X-Frame-Options is also widely encountered and may be retained for compatibility with older clients.
Example: only allow the same origin to frame the page
Common legacy equivalent
The correct policy depends on legitimate framing requirements. Applications that need to be embedded by trusted third parties should use an appropriately scoped Content Security Policy rather than blindly blocking all framing.
Don't panic. Clickjacking is usually a small finding. But if one security control was missed, what else might be hiding? KobReySec performs hands-on penetration testing designed to find, validate, and explain security issues in the context of your application.