Clickjacking
A UI redress attack that tricks users into clicking hidden interface elements by overlaying invisible frames on top of legitimate content.
Clickjacking, also known as a UI redress attack, is a technique where an attacker tricks a user into clicking on something different from what they perceive they are clicking on. The attack works by loading a target website in a transparent or hidden iframe overlaid on top of a decoy page. When the user clicks what appears to be a benign element on the visible page — a button, link, or game — they are actually interacting with the hidden page underneath, potentially triggering actions they did not intend.
The attack exploits the HTML iframe element and CSS properties like opacity and positioning. An attacker creates a page with attractive or compelling content (a fake game, a prize claim form, or a video play button) and positions a transparent iframe containing the target application precisely over the clickable elements. The victim sees only the decoy content but their clicks are registered by the hidden iframe. More advanced variants include drag-and-drop clickjacking (hijacking drag events to move data between contexts), cursorjacking (manipulating the cursor position so clicks land on different elements), and multi-step clickjacking (guiding users through a sequence of hidden actions).
Clickjacking has been used to hijack social media likes and follows, change security settings, initiate fund transfers, enable webcams, and grant permissions on OAuth consent screens. The primary defense is the X-Frame-Options HTTP header or the more flexible Content-Security-Policy frame-ancestors directive, which controls whether a page can be embedded in iframes. Additional protections include frame-busting JavaScript (though this can be bypassed), requiring user interaction beyond a single click for sensitive actions, and implementing confirmation dialogs for critical operations.
The attack exploits the HTML iframe element and CSS properties like opacity and positioning. An attacker creates a page with attractive or compelling content (a fake game, a prize claim form, or a video play button) and positions a transparent iframe containing the target application precisely over the clickable elements. The victim sees only the decoy content but their clicks are registered by the hidden iframe. More advanced variants include drag-and-drop clickjacking (hijacking drag events to move data between contexts), cursorjacking (manipulating the cursor position so clicks land on different elements), and multi-step clickjacking (guiding users through a sequence of hidden actions).
Clickjacking has been used to hijack social media likes and follows, change security settings, initiate fund transfers, enable webcams, and grant permissions on OAuth consent screens. The primary defense is the X-Frame-Options HTTP header or the more flexible Content-Security-Policy frame-ancestors directive, which controls whether a page can be embedded in iframes. Additional protections include frame-busting JavaScript (though this can be bypassed), requiring user interaction beyond a single click for sensitive actions, and implementing confirmation dialogs for critical operations.
Examples
- A user clicks a "Play Video" button on a decoy page but actually clicks a hidden "Like" button on a social media site loaded in a transparent iframe.
- An invisible iframe over a game causes users to unknowingly change their email settings or grant OAuth permissions.
- A clickjacking attack on a banking site tricks users into clicking a hidden "Confirm Transfer" button while interacting with a fake survey.
Prevention
- Set the X-Frame-Options header to DENY or SAMEORIGIN to prevent your pages from being loaded in iframes.
- Use the Content-Security-Policy frame-ancestors directive for more granular iframe embedding control.
- Require multi-step confirmation for sensitive actions to prevent single-click exploitation.
- Implement server-side protections rather than relying solely on client-side frame-busting scripts.