Definition
Clickjacking is a UI redressing attack where an attacker deceives a user into clicking on a seemingly safe webpage element that conceals a hidden malicious element. This often involves transparent iframes to execute actions without the user's knowledge.How It Works
- 1An attacker creates a webpage with a transparent iframe.
- 2This iframe is placed over a legitimate button or link on a webpage.
- 3The user clicks the visible button, unknowingly activating the hidden iframe's function.
Key Characteristics
- Involves transparent or opaque overlays.
- Depends on user interaction.
- Targets actions like clicks, keystrokes, or drag-and-drop.
Comparison
| Concept | Description |
|---|---|
| Phishing | Tricks users into providing personal data. |
| Cross-Site Scripting (XSS) | Inserts malicious scripts into websites. |
| Clickjacking | Misleads users into clicking concealed elements. |
Real-World Example
CVE-2008-3834 describes a vulnerability where a webpage's content could be obscured and replaced with an attacker-controlled iframe, leading to unauthorized actions.Detection & Prevention
- Use the
X-Frame-OptionsHTTP header to block framing. - Implement
Content Security Policy (CSP)with theframe-ancestorsdirective. - Test with tools like Burp Suite's Clickbandit to simulate clickjacking.
- Frame-busting JavaScript alone is often ineffective, as attackers can bypass it.
Common Misconceptions
- Frame-busting scripts alone are enough: They can be bypassed by attackers.
- Clickjacking is only about clicks: It can involve other interactions like typing or dragging.
- It's only a concern for large sites: Any site with user interactions can be targeted.