What is Clickjacking? Tutorial & Examples
Summary: Clickjacking is an interface-based attack in which a user is tricked into clicking actionable content on a hidden website by clicking on decoy content, typically an invisible iframe overlaid on a decoy page using CSS position and z-index values with opacity near 0.0. PortSwigger notes that CSRF tokens do not mitigate clickjacking because the target session is established with content loaded from an authentic website and all requests happen on-domain, and that frame busting scripts can be neutralized with the HTML5 iframe sandbox attribute when allow-forms or allow-scripts is set and allow-top-navigation is omitted.
Key Takeaway: The attack needs only that a site can be framed, and the source notes frame busting is often straightforward to circumvent, so protection rests on server-side headers: X-Frame-Options, which is not implemented consistently across browsers (the allow-from directive is unsupported in Chrome 76 and Safari 12), and the CSP frame-ancestors directive.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026