"In a clickjacking attack, the attacker creates a decoy webpage and embeds a legitimate target website in an iframe. The attacker manipulates the iframe's position, opacity, or other visual properties so the victim sees the decoy interface while their clicks actually interact with the legitimate website. This can trick the victim into performing unintended sensitive actions."
Content-Security-Policy: frame-ancestors ... X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN Appropriate application-level controls
Recon
↓ Find sensitive action
↓ Capture target page in Burp
↓ Check X-Frame-Options / CSP frame-ancestors
↓ Try framing the page
↓ Identify frame-buster JavaScript
↓ Understand how the frame-buster detects framing
↓ Use the lab's sandbox-based bypass condition
↓ Create clickjacking PoC
↓
Align decoy with target action
↓ Test in the lab
↓ Perform the required action
↓ Lab solved