I created a framekiller script in such way it allows framing a page only in selected domain to prevent clickjacking. Framekiller Code:
<style id="antiClickjack">
body {
display: none !important;
}
</style>
<script>
if (top.length > 0)
{
if (self.location == top.location) {
alert("same");
var antiClickjack = document.getElementById("antiClickjack");
antiClickjack.parentNode.removeChild(antiClickjack);
}
else if (self.location.hostname == top.location.hostname || self.location.hostname.toString() == "www.TrustedSite1.com" || self.location.hostname.toString() == "www.TrustedSite2.com")
{
var antiClickjack = document.getElementById("antiClickjack");
antiClickjack.parentNode.removeChild(antiClickjack);
}
else
{
top.location.replace(self.location);
}
}
else
{
var antiClickjack = document.getElementById("antiClickjack");
antiClickjack.parentNode.removeChild(antiClickjack);
}
</script>
But latest browser Follow SAME ORIGIN POLICY so it's not allowing executes framekiller script in Other Websites (trusted websites)
My question is "How to bypass the same origin policy to execute framekiller script on a different domain"
Thank You.