I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in that article, and I got the message
“You’ve been clickjacked!” at the top of the page, indicating my web application is vulnerable to this type of attack:
To test whether a site is vulnerable to clickjacking, create an HTML page similar to the following, changing the URL highlighted in RED to point to your target site:
<html> <head> <title>Clickjack test page</title> </head> <body> <p>You’ve been clickjacked!</p> <iframe sandbox="allow-scripts allow-forms" src="http://localhost:8080" style="width:100%;height:90%"></iframe> </body> </html>
If you see the text “You’ve been clickjacked!” at the top of the page, your site is vulnerable.
How does that prove my website is vulnerable?