Based on the information in a report from a web application scanner, a website is susceptible to clickjacking. Which of the following techniques would be best to use to prove this exploit?

Capturing and replaying a session ID is related to session hijacking, not clickjacking.

Redirecting the user with a CSRF (Cross-Site Request Forgery) is a different type of attack where an attacker tricks a user's browser into making an unwanted request to a trusted site, without direct interaction with the targeted UI.

Launching the website in an inline frame (iframe) is the primary method to demonstrate clickjacking. An attacker can embed a vulnerable website within an iframe on a malicious page and then layer transparent elements or other UI elements over it to trick users into interacting with the embedded site. This technique directly exploits how browsers handle framed content, allowing the attacker to manipulate user input on the victim site.

Pulling server headers might reveal security configurations like X-Frame-Options, but it doesn't prove the exploit; it only indicates potential susceptibility or mitigation.