Clickjacking
Last updated
Last updated
Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is “hijacking” clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.
The below demonstrates a simple Clickjacking PoC:
Please note that for Clickjacking to be considered a vulnerability, you also have to demonstrate impact. Showing that you can trick a user into performing a mass administrative action or updating information such as their profile / billing information is a better PoC than simply embedding the home page in an iFrame.