Clickjacking
What is Clickjacking
Clickjacking is a type of malicious technique used by attackers to trick users into clicking on something they didn't intend to click on. It involves overlaying or hiding a malicious element on top of a legitimate website or web page. When the user interacts with the visible content, they unknowingly trigger an action on the hidden element, which can have unintended and harmful consequences.
Here is how clickjacking works:
The attacker creates a webpage or finds a vulnerable website that can be used for clickjacking.
The attacker then overlays or positions a transparent or opaque layer on top of the website, making it invisible or barely noticeable to the user.
The attacker entices the user to visit the compromised webpage or the vulnerable website, often through social engineering or misleading links.
When the user interacts with the visible content on the webpage, such as clicking a button, they are actually interacting with the hidden element underneath.
The hidden element could be anything from a malicious link, a hidden advertisement, a social media action, or even executing unintended commands on the user's behalf.
Since the user is unaware of the hidden element, they unknowingly perform actions they didn't intend to, potentially leading to various security risks or unauthorized activities.
Clickjacking attacks can be used for several malicious purposes, including stealing sensitive information, hijacking social media accounts, spreading malware, or even performing financial transactions without the user's consent.
Clickjacking PoC
How to report it
Note: Here is an example on how to report it, CVSS score is here as a reference but you should always check out the context of your customer to calculate it
Resources
Last updated
