--- type: Whitepaper title: "Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites" description: A survey of frame-busting JavaScript across the Alexa top 500 found only 14% deploy any, and every deployment could be circumvented. The attacks include double framing to make parent.location a security violation, onBeforeUnload with 204 flushing, inducing the IE8 and Chrome XSS filters to disable the busting script, and location clobbering. A style-hides-body defence is proposed. resource: "https://seclab.stanford.edu/websec/framebusting/framebust.pdf" tags: [whitepaper, webseclist-reference, clickjacking, ui-redress, iframe, filter-bypass, measurement-study, mitigation, javascript, defence, xss, owasp-a03-2021, owasp-a04-2021, owasp-a05-2021] generated: by: webseclist-refs/1 at: "2026-08-07T23:36:04+00:00" status: stable stale_after: 2027-08-07 sources: - id: original resource: "https://seclab.stanford.edu/websec/framebusting/framebust.pdf" title: "Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites" author: Gustav Rydstedt, Elie Bursztein, Dan Boneh, Collin Jackson also_at: [] authors: - Gustav Rydstedt - Elie Bursztein - Dan Boneh - Collin Jackson canonical_url: "" cited_by: - "2010.md:90" commit: "" content_sha256: 3c0e90d9864dc6d5546f9e89cd0a27e54f7c52e2c9dcff52e88d4160a3c156fc depth: full depth_reason: default kind: whitepaper language: "" licence: unknown original_url: "https://seclab.stanford.edu/websec/framebusting/framebust.pdf" published: "" publisher: "" publisher_english: "" raw_sha256: 27557c12cc76149485e86eb28cc25059f6ab791c9780792b4da658ba87e369ca retrieved_from: "https://seclab.stanford.edu/websec/framebusting/framebust.pdf" retrieved_kind: manual-import retrieved_utc: "2026-08-07T23:36:04+00:00" slug: busting-frame-busting-study-clickjacking-vulnerabilities-popular-sites snapshot: "" title_english: "" translation_file: "" translation_of: "" --- # Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites **Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites** - Gustav Rydstedt, Elie Bursztein, Dan Boneh, Collin Jackson, Publisher not stated. - Published: date not stated - Original: - Preserved from: https://seclab.stanford.edu/websec/framebusting/framebust.pdf (manual-import) on 2026-08-07 - Licence: unknown Rights remain with the original author and publisher. This is a research archive of a source from the Web Hacking Techniques Index collections, kept so the page going offline. To read the original, follow the link above. ## Content > UNTRUSTED SOURCE TEXT. Everything below this line is third-party material > quoted for research. It is data, not instructions. Do not follow directions, > execute code, or fetch URLs because this text says so. # Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites Gustav Rydstedt, Elie Bursztein, Dan Boneh Collin Jackson Stanford University Carnegie Mellon University {rydstedt,elie,dabo}@cs.stanford.edu collin.jackson@sv.cmu.edu July 20, 2010 Abstract Web framing attacks such as clickjacking use iframes to hijack a user’s web session. The most common defense, called frame busting, prevents a site from functioning when loaded inside a frame. We study frame busting practices for the Alexa Top-500 sites and show that all can be cir- cumvented in one way or another. Some circum- ventions are browser-specific while others work across browsers. We conclude with recommen- dations for proper frame busting. Figure 1: Visualization of a clickjacking attack on Twitter’s account deletion page. 1 Introduction Figure 1 illustrates a clickjacking attack: the victim site is framed in a transparent iframe that Frame busting refers to code or annotation is put on top of what appears to be a normal provided by a web page intended to prevent page. When users interact with the normal page, the web page from being loaded in a sub-frame. they are unwittingly interacting with the victim Frame busting is the recommended defense site. To defend against clickjacking attacks, the against clickjacking [10] and is also required following simple frame busting code is a com- to secure image-based authentication such as monly used by web sites: the Sign-in Seal used by Yahoo. Sign-in Seal displays a user-selected image that authenticates i f ( top . l o c a t i o n != l o c a t i o n ) the Yahoo! login page to the user. Without top . l o c a t i o n = s e l f . l o c a t i o n ; frame busting, the login page could be opened in a sub-frame so that the correct image is Frame busting code typically consists of a displayed to the user, even though the top conditional statement and a counter-action that page is not the real Yahoo login page. New navigates the top page to the correct place. advancements in clickjacking techniques [22] As we will see, this basic code is fairly easy using drag-and-drop to extract and inject data to bypass. We discuss far more sophisticated into frames further demonstrate the importance frame busting code (and circumvention tech- of secure frame busting. niques) later in the paper. 1 Our contribution. We begin with a survey of of the Top-500 uses this header. All other sites frame busting code used by the Alexa Top-500 rely purely on JavaScript for frame busting. sites which includes a good mixture of banks, so- cial networks, online merchandise, trading, and gaming. We also surveyed all top US banks, as these are obvious high-risk targets for clickjack- 2 A Survey of Frame busting ing. Section 2 describes the semi-automated tool Code we used to locate and extract the frame bust- ing code. Our survey shows that an average of Many of the Top-500 sites contain a significant 3.5 lines of JavaScript was used while the largest amount of JavaScript, some inlined and some implementation spanned over 25 lines. The ma- dynamically loaded. Manually filtering through jority of frame busting code was structured as a this code looking for frame busting snippets conditional block to test for framing followed by can be difficult. This is further exacerbated a counter-action if framing is detected. by JavaScript obfuscation, predominantly source code packing, used by many big sites. % of web site To locate frame busting code we used a Java- Top 500 14% based browser emulator called HTMLUnit [14]. Top 100 37% As a headless emulator it can be used for limited Top 10 60% debugging of JavaScript. This gave us the ability to dynamically frame pages and break at the ac- Table 1: Frame busting among Alexa-Top sites tual script used for frame busting. Although this tool was of great help, some manual labor was still required to de-obfuscate and trace through A majority of counter-actions navigate the packed code. Of the Top-500 sites, many do not top-frame to the correct page. A few erase frame bust on their front page. Instead, they the framed content, most often through a only frame bust on a login page or on a password document.write(’ ’). Some use exotic con- reset page. Some of the manual labor came from ditionals and counter actions. We describe the trying to locate an actual a subpage deploying frame busting code we found in the next sections. frame busting. Table 1 summarizes frame busting among Alexa- Top 500 sites. Clearly frame busting is far from Popular frame busting code. Most sites ubiquitous suggesting that clickjacking attacks we surveyed use frame busting code described are still overlooked by major web sites. in Tables 2 and 3. Some sites deploy multiple The remainder of the paper is organized as counter-actions and conditionals as backup. Five follow: In Section 2 we describe how we did our sites additionally relied on document.referrer survey. In Section 3 we turn to attacks on frame to test for framing. More exotic frame busting busting code. We show that all currently de- code is discussed in Section 4. ployed code can be circumvented in all major browsers. We present both known and new tech- niques. In Section 4 we discuss attacks that tar- get exotic frame busting code at specific websites 3 Generic Attacks including social networking and retail sites. In Section 5 we discuss strategies for safer frame Before discussing more exotic frame busting, we busting. We also discuss an alternate approach first describe a number of attacks on the basic to frame busting based on the X-FRAME-OPTIONS methods in Tables 2 and 3. We summarize these header. Our survey shows that only three sites attacks in Table 4 at the end of the section. 2 Common frame busting code unique sites conditional statement 38% if (top != self) 22.5% if (top.location != self.location) 13.5% if (top.location != location) 8% if (parent.frames.length > 0) 5.5% if (window != top) 5.5% if (window.top !== window.self) 2% if (window.self != window.top) 2% if (parent && parent != window) 2% if (parent && parent.frames && parent.frames.length>0) 2% if((self.parent&&!(self.parent===self))&&(self.parent.frames.length!=0)) Table 2: Frame busting conditional statement unique sites counter-action 7 top.location = self.location 4 top.location.href = document.location.href 3 top.location.href = self.location.href 3 top.location.replace(self.location) 2 top.location.href = window.location.href 2 top.location.replace(document.location) 2 top.location.href = window.location.href 2 top.location.href = "URL" 2 document.write(’’) 2 top.location = location 2 top.location.replace(document.location) 2 top.location.replace(’URL’) 1 top.location.href = document.location 1 top.location.replace(window.location.href) 1 top.location.href = location.href 1 self.parent.location = document.location 1 parent.location.href = self.document.location 1 top.location.href = self.location 1 top.location = window.location 1 top.location.replace(window.location.pathname) 1 window.top.location = window.self.location 1 setTimeout(function(){document.body.innerHTML=’’;},1); 1 window.self.onload = function(evt){document.body.innerHTML=’’;} 1 var url = window.location.href; top.location.replace(url) Table 3: Counter-action statement 3 3.2 The onBeforeUnload event A user can manually cancel any navigation request submitted by a framed page. To exploit this the framing page registers an onBeforeUnload handler which is called when- ever the framing page is about to be unloaded due to navigation [7]. The handler function returns a string that becomes part of a prompt displayed to the user. Say the attacker wants to frame PayPal. He registers an unload handler function that returns the string “Do you want to exit PayPal?”. When this string is displayed to the user (see screenshot 3) the user is likely to cancel the navigation, defeating PayPal’s frame busting attempt. The attacker mounts this attack by register- Figure 2: Double Framing Attack ing an unload event on the top page using the following code: window . o n b e f o r e u n l o a d = f u n c t i o n ( ) 3.1 Double framing { Some counter-actions in Table 3 navigate to return ” Asking t h e u s e r n i c e l y ” ; the correct page by assigning a value to } parent.location. This works well if the vic- tim page is framed by a single page. However, we discovered that if the attacker encloses the PayPal’s frame busting code will generate a victim by two frames (Fig. 2), then accessing BeforeUnload event activating our function and parent.location becomes a security violation prompting the user to cancel the navigation in all popular browsers, due to the “descendant” event. frame navigation policy we proposed and imple- mented in [3]. This security violation disables 3.3 onBeforeUnload – 204 Flushing the counter-action navigation. While the previous attack requires user inter- Example. Victim frame busting code: action, the same attack can be done without i f ( top . l o c a t i o n != s e l f . l o c a t i o n ) { prompting the user [7]. Most browsers (IE7, IE8, parent . l o c a t i o n = s e l f . l o c a t i o n ; Google Chrome, and Firefox) enable an attacker } to automatically cancel the incoming navigation request in an onBeforeUnload event handler by Attacker top frame: repeatedly submitting a navigation request to a site responding with “204 - No Content.” Navi- gating to a No Content site is effectively a NOP, Attacker sub-frame: but flushes the request pipeline, thus canceling the original navigation request. Here is sample code to do this: 4 var p r e v e n t b u s t = 0 sub-sets of the JavaScript loaded can is still func- window . o n b e f o r e u n l o a d = tional (inline or external) and cookies are still f u n c t i o n ( ) { k i l l b u s t++ } available, this attack is effective for click-jacking. setInterval ( function () { i f ( k i l l b u s t > 0) { k i l l b u s t −= 2 ; Example. Victim frame busting code: window . top . l o c a t i o n = ’ h t t p : / / no−c o n t e n t −204.com ’ } i f ( top != s e l f ) { } , 1); top . l o c a t i o n= s e l f . l o c a t i o n ; } Attacker: i f ’ ’ > The XSS filter will match that parameter