# Clickjacking Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is “hijacking” clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both. The below demonstrates a simple Clickjacking PoC: ```markup 


ClickJacking PoC

ClickJacking PoC

Oops! The website is vulnerable to Clickjacking!
``` Please note that for Clickjacking to be considered a vulnerability, you also have to demonstrate impact. Showing that you can trick a user into performing a mass administrative action or updating information such as their profile / billing information is a better PoC than simply embedding the home page in an iFrame. ### References {% embed url="" %} {% embed url="" %} --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://ttp.parzival.sh/pentesting/web-applications/clickjacking.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.