> For the complete documentation index, see [llms.txt](https://gowsundar.gitbook.io/book-of-bugbounty-tips/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowsundar.gitbook.io/book-of-bugbounty-tips/clickjacking.md).

# Clickjacking

* [The site i'm testing sets X-FRAME-OPTIONS:DENY if you try to iframe their site because it detects the Referer: header and tries to prevent clickjacking. Using  iframes their site w/ no referrer :) #bugbountytips](https://twitter.com/zseano/status/1008835255669837824)
* [If there is a clickjacking vulnerability, however, vulnerable parameters like buttons or other things are down below the end of the page, that means you've to perform scroll with iframe. In that case, initiate an auto-scroll script with iframe](https://twitter.com/kunalp94/status/1055668548943536129)