Web Security
Clickjacking
Trick users into clicking something they never intended to. By overlaying a transparent iframe over a decoy UI, attackers hijack button clicks, fund transfers, OAuth grants, and account deletions — no JavaScript required.
Intermediate35 min6 lessons1 hands-on
First lesson free. The full module is part of Pro.
You'll be able to
- ✓Explain the UI redressing attack model and why transparent iframes are dangerous
- ✓Detect frameable pages by checking X-Frame-Options and CSP frame-ancestors
- ✓Build a clickjacking PoC that positions a decoy over a real sensitive button
- ✓Understand multi-step and drag-and-drop jacking variants
- ✓Apply frame-ancestors CSP and SameSite cookies to prevent clickjacking