Burp Clickbandit: A Java Script based clickjacking PoC generator
Summary: PortSwigger released Burp Clickbandit, a JavaScript tool that generates clickjacking proof-of-concept attacks by recording a sequence of clicks and using element dimensions and position to build the click area. It runs in all modern browsers except Internet Explorer and Microsoft Edge, detects cross-domain clicks via the window blur event, and lets the tester adjust zoom and iframe position before saving the attack locally.
Bottom line: The tool turns hours of manual offset-tweaking into a point-and-click recording, which lowers the effort needed to demonstrate that a page can be framed and clicked through - and the same technique works against any site that lacks frame-busting controls.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026