Clickjacking

Clickjacking is an attack that overlays a decoy page with a transparent iframe so the victim unknowingly clicks buttons on the target site.

Purpose

To prevent attackers from borrowing the victim clicks to trigger sensitive operations.

Mechanism

The attacker page contains <iframe src="target.com/delete" style="opacity:0"> layered over a decoy button. Clicking the decoy actually clicks the target button inside the iframe. Defenses: X-Frame-Options: DENY or CSP frame-ancestors to restrict embedding.

Use cases

Tricking clicks on delete/transfer buttons
Social media like-jacking
Permission grant hijacking
Ad click fraud

Examples

Input

<iframe src="target/delete" opacity=0>

Output

Clickjacked deletion

Transparent iframe

Common errors

No X-Frame-Options or CSP frame-ancestors set: Set DENY or SAMEORIGIN

Related terms

XSS (cross-site scripting) is attackers injecting malicious scripts into a page that execute in other users browsers; it comes in stored, reflected, and DOM-based forms.

CSRF (cross-site request forgery) is a vulnerability where the attacker tricks a logged-in user into unknowingly sending a malicious request to the target site.

CSP (Content Security Policy) declares, via an HTTP header, which resource origins a page may load, shrinking the attack surface for XSS and data injection.

Security Header

Security HTTP headers are response headers instructing the browser to enable security mechanisms, such as CSP, HSTS, and X-Frame-Options.

References