Testing for clickjacking - Port Swigger
Summary: PortSwigger describes clickjacking as a web security vulnerability where an attacker overlays a disguised or invisible UI layer, usually using iframes, on top of a target page so users click hidden elements while believing they are doing something else. The article notes that manually building a clickjacking proof of concept is tedious and time-consuming, and recommends Burp's Clickbandit tool for testing vulnerable pages.
Bottom line: The attack works by making a user's click land on an element they never saw, so a single convincing overlay can turn an ordinary visit into an action taken on the attacker's behalf.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026