CLICKJACKING
Instagram: h4cker_fawad
Clickjacking is a client-side web security vulnerability where an attacker manipulates a user’s perception
of a web page interface and forces them to interact with hidden or disguised UI elements.
Unlike server-side attacks (SQLi, RCE), Clickjacking is based on:
Human deception + UI manipulation + browser rendering behavior
CORE CONCEPT (ATTACK MODEL)
1. Clickjacking relies on three core assumptions:
2. Users trust visible UI elements
3. Browsers allow iframe embedding (if not restricted)
4. CSS can manipulate transparency and layering
Attack Equation:
User Click + Hidden Layer + Misaligned UI = Unauthorized Action
VISUAL ATTACK MODEL
Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious
technique of tricking a Web user into clicking on something different from what the user
perceives they are clicking on, thus potentially revealing confidential information or
taking control of their computer while clicking on seemingly innocuous web pages. The
server didn't return an X-Frame-Options header which means that this website could be
at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used
to indicate whether or not a browser should be allowed to render a page in a <frame>
or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their
content is not embedded into other sites. This vulnerability affects Web Server. Impact:
An attacker can host this domain in other evil site by using iframe and if a user fill the
given filed it can directly redirect as logs to attacker and after its redirect to your web
server.. its lead to steal user information too and use that host site as phishing of your
site its CSRF and Clickjacking POC:
IClickjacking Script:
[Link] notepad and paste the
following code
<html><head>
<title>leaseweb</title>
<style>
frame {
opacity: 0.5;
border: none;
position: absolute;
top: 0px;
left: 0px;
z-index: 1000;
</style>
</head>
<body>
<script>
[Link] = function()
{
return " Do you want to leave ?";
</script>
<p> site is vulnerable for CSRF!</p>
<iframe id="frame" width="100%" height="100%" src="[Link]
iframe> </body>
</html>
[Link] it as <anyname>.html eg [Link]
[Link] just simply open that..
As far as i know this data is enough to prove that your site is vulberable to Clickjacking..
according to OWASP its more than enough..
[Link]
⚔ ATTACK TYPES (DEEP CLASSIFICATION)
1. Classic UI Redressing Attack
This is the base form of Clickjacking.
🔹 Mechanism:
1. Attacker creates a webpage
2. Adds a legitimate site inside iframe
3. Makes iframe invisible
4. Overlays fake clickable UI
🔹 Example:
<div style="opacity:0; position:absolute; top:0; left:0; width:100%; height:100%;">
<iframe src="[Link]
</div>
🔹 Attack Outcome:
User clicks thinking it's attacker UI → actually clicks vic m site bu on.
2. iFrame Position Tracking Attack (Advanced)
Attackers dynamically align hidden elements.
🔹 Technique:
1. Track mouse movement
2. Move iframe under cursor
3. Align malicious button under click point
🔹 Example:
[Link]("mousemove", function(e){
[Link]("frame").[Link] = [Link] + "px";
[Link]("frame").[Link] = [Link] + "px";
});
Impact:
1. Precise click targeting
2. Bypasses static UI detection
3. Drag-and-Drop Clickjacking
Modern variation abusing drag events.
🔹 Attack Flow:
1. User drags element
2. Hidden iframe captures drop event
3. Action executed silently
🔹 Risk:
1. File uploads
2. Authorization actions
3. UI state changes
4. Cursor Hijacking (Rare Advanced Variant)
1. Attacker manipulates pointer behavior.
2. Fake cursor overlay
3. Misleading click location
4. UI misalignment tricks
5. Nested Frame Clickjacking
Attack uses multiple iframe layers:
Layer 1: fake UI
Layer 2: real victim site
Layer 3: hidden action trigger
REAL-WORLD ATTACK SCENARIO
🎯 Target: Banking site
Attack Steps:
1. Victim opens attacker page
2. Page loads bank login inside hidden iframe
3. Fake “Watch Video” button is displayed
4. User clicks button
5. Hidden iframe executes:
“Transfer Funds”
or “Change Email”
or “Authorize Device”
💥 Result:
User unknowingly performs banking operation.
🔥 MODERN BYPASS TECHNIQUES
1. Frame Busting Evasion
Old websites use:
if (top != self) {
[Link] = [Link];
Bypass Methods:
1. JS disabling
2. sandboxed iframe
3. timing interference
4. unload event manipulation
3. onBeforeUnload Trick (Advanced)
[Link] = function() {
return "Are you sure?";
};
Effect:
4. Prevents frame breaking
5. Forces user to stay inside attacker page
3. Rapid Navigation Loop
setInterval(function(){
[Link] = "[Link]";
}, 1);
Effect:
1. Breaks browser escape behavior
2. Locks victim inside attack frame context
4. XSS FILTER SIDE EFFECTS
1. Older browsers (IE8 / Chrome XSS Auditor):
2. Modify request payload
3. Disable scripts
4. Break frame-busting logic
5. Leads to accidental Clickjacking bypass
DETECTION METHODS
1. Manual Testing
1. Try embedding site in iframe
2. Observe frame blocking behavior
3. Check response headers
2. Automated Scanning Tools
1. Burp Suite Clickjacking Plugin
2. OWASP AP
3. Custom iframe injection scripts
3. DOM Inspection
Check:
1. iframe presence
2. opacity manipulation
3. absolute positioning abuse
DEFENSE MECHANISMS (DEEP EXPLANATION)
1. 🛑 X-Frame-Options (Legacy Defense)
X-Frame-Options: DENY
Modes:
DENY → blocks all framing
SAMEORIGIN → allows same domain only
ALLOW-FROM → deprecated
2. Content Security Policy
Content-Security-Policy: frame-ancestors 'none';
or
frame-ancestors 'self';
Advantages:
1. More flexible than X-Frame-Options
2. Modern browser support
3. Strong protection against UI redressing
3. JS FRAME BUSTING (WEAK DEFENSE)
if (top !== self) {
[Link] = [Link];
Weakness:
1. Can be bypassed via sandbox iframe
2. Disabled JS breaks it completely
4. SANDBOX ISOLATION
<iframe src="[Link]" sandbox></iframe>
Restrictions:
1. No scripts
2. No form submission
3. No top navigation
IMPACT ANALYSIS (REAL SECURITY VIEW)
Clickjacking can lead to:
💰 Financial Impact:
Unauthorized transfers
Payment approvals
🔐 Security Impact:
MFA changes
Account takeover preparation
📉 Reputation Impact:
Fake social interactions (likes, follows)
Forced actions on user profiles
MODERN EVOLUTION OF CLICKJACKING
Today Clickjacking evolved into:
1. OAuth consent phishing
2. UI automation abuse
3. Cross-frame request hijacking
4. AI UI deception attacks (emerging)
📌 KEY TAKEAWAYS
Clickjacking = UI deception, not code injection
Works purely on browser rendering + human trust
Most powerful when combined with:
1. CSRF
2. weak authentication flows
3. missing CSP/X-Frame protections
FINAL SUMMARY
> Clickjacking is a browser-based UI manipulation attack where invisible or disguised layers trick users
into executing unintended actions inside trusted applications.