Sober-ClickjackingTools
Full security header audit — Clickjacking, CORS, HSTS, CSP, X-Content-Type-Options, Referrer Policy, Permissions Policy & Server Disclosure. Generates live PoC + PDF report.
Authorized Use
Use only for ethical purposes. Scan only systems you own or have written authorization to test. Not for use against third-party sites without authorization.
// Full Security Audit — Single URL
// Batch URL Scanner — Faculty Lab Assessment
Paste one URL per line. Max 20 URLs. Full 8-check audit on each URL.
// How It Works — Teaching Guide
Header Fetch
Server fetches the target URL and captures all response headers. CORS limitations do not apply since the check runs server-side.
8-Check Audit
Checks Clickjacking, CORS, HSTS, X-Content-Type-Options, CSP, Referrer-Policy, Permissions-Policy, and Server version disclosure.
Live PoC
For vulnerable targets: live iframe + overlay demo shows UI redressing in action. Students see the attack and immediately understand the risk.
PDF Report
One click exports a professional PDF report with all findings, severity ratings, and fix instructions — ready to share with the client or examiner.