Click-Jackalope - Clickjacking POC generator

Click-Jackalope generates clickjacking proof-of-concept pages from target URLs and inspects response headers for frame-defense directives. It adds a dedicated tab and context menu items for extracting URLs from intercepted traffic, producing ready-to-use HTML test pages, and documenting framing behavior for reports.

Features

• Inspects X-Frame-Options and CSP frame-ancestors headers from selected responses and explains the expected framing outcome.
• Generates clickjacking PoC pages from three templates: standard, decoy-login, and banner-lure.
• Provides an in-extension HTML preview before saving or opening the generated page in a browser.
• Can serve the generated PoC over localhost for HTTP-based testing in addition to local-file testing.
• Adds context menu items in Proxy, Target, Repeater, and Logger to pre-populate the target URL from a selected request.
• Copies concise report-ready notes summarising the target and observed frame-defense headers.
• Makes iframe sandboxing optional and escapes untrusted URL content before rendering it into generated HTML.

Usage

1. Open the Click-Jackalope tab after loading the extension.
2. Paste a target URL into the URL field, or right-click a request in Proxy, Target, Repeater, or Logger and select Create Click-Jackalope POC to pre-populate the target automatically.
3. Review the header analysis panel to see how X-Frame-Options and frame-ancestors directives affect framing for the selected response.
4. Select a PoC template (standard, decoy-login, or banner-lure) from the template selector.
5. Use the in-extension preview to inspect the generated HTML before committing to it.
6. Save the HTML file locally and open it in a browser to verify framing behavior, or enable localhost serving mode to test over HTTP instead of a local file path.
7. Use the copy notes function to export a concise report-ready summary of the target URL and observed frame-defense headers.