Unsafe page
No framing protection. Build the overlay and prove the click lands.
The set 2
Safe page
The same page done right. Compare the response headers.
Nothing matches thatClear the filter to see everything again.
Frame the target, borrow the victim's clicks. One page here is protected and one is not - diff the headers.
Nothing here is a coding mistake. A wildcard CORS origin, a CSP with unsafe-inline, a Host header the app trusts, an open redirect - each is a setting that someone chose, and each one is a lever for a bigger bug rather than a finding on its own.
No framing protection. Build the overlay and prove the click lands.
The same page done right. Compare the response headers.