clickjacking-tester/app.py at main · tanish-mahajan/clickjacking-tester · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
from flask import Flask, render_template_string, request, make_response
import requests

app = Flask(__name__)

HTML = """
<!DOCTYPE html>
<html>
<head>
    <title>Clickjacking Tester</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 40px; }
        input[type=text], button { padding: 8px; font-size: 16px; }
        iframe { margin-top: 20px; width: 100%; height: 500px; border: 2px solid #555; }
        .error { color: red; font-weight: bold; }
    </style>
</head>
<body>
    <h2>🔒 Clickjacking Test Tool</h2>
    <form method="GET">
        <input type="text" name="url" placeholder="Enter site (e.g. example.com)" value="{{ user_input or '' }}" required />
        <button type="submit">Check</button>
    </form>
    {% if error %}
        <p class="error">❌ {{ error }}</p>
    {% elif url %}
        <h3>✅ Framing: {{ url }}</h3>
        <iframe src="{{ url }}"></iframe>
        <form method="POST" action="/download">
            <input type="hidden" name="target" value="{{ url }}">
            <button type="submit">⬇️ Download PoC HTML</button>
        </form>
    {% endif %}
</body>
</html>
"""

@app.route("/", methods=["GET", "POST"])
def home():
    user_input = request.args.get("url", "").strip()
    url = None
    error = None

    if user_input:
        if not user_input.startswith("http"):
            url = "https://" + user_input
        else:
            url = user_input

        try:
            resp = requests.head(url, timeout=5, allow_redirects=True)
            headers = resp.headers

            xfo = headers.get("X-Frame-Options", "").lower()
            csp = headers.get("Content-Security-Policy", "").lower()

            if "deny" in xfo or "sameorigin" in xfo or "frame-ancestors" in csp:
                error = "Not Working: Site is protected with security headers"
                url = None
        except Exception as e:
            error = f"Error: {e}"
            url = None

    return render_template_string(HTML, url=url, error=error, user_input=user_input)

@app.route("/download", methods=["POST"])
def download():
    target = request.form.get("target")
    poc_html = f"""<!DOCTYPE html>
<html>
<head><title>Clickjacking PoC</title></head>
<body>
    <h2>Clickjacking PoC for: {target}</h2>
    <iframe src="{target}" width="100%" height="800" style="border:2px solid red;"></iframe>
</body>
</html>
"""
    response = make_response(poc_html)
    response.headers['Content-Disposition'] = 'attachment; filename=clickjacking_poc.html'
    response.mimetype = 'text/html'
    return response

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=80)