Clickjacking is an attack where the attacker overlays their own UI over a web page, "hijacking" the clicks that the victim makes on the page.

learn more… | top users | synonyms

2
votes
2answers
35 views

How to set X-FRAME-OPTIONS where 3rd Party frame is required to be loaded?

We have set the set X-Frame-Options in the header as ALLOW-FROM same origin but there is a requirement to open below page from some 3rd party website. Do you see security issue here? HTTP::header ...
6
votes
1answer
65 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
2
votes
1answer
94 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
3
votes
2answers
78 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
1
vote
4answers
79 views

how can this prove a clickjacking vulnerability?

How does just putting a site link in an iframe (and when opens in iframe) indicate that the site is vulnerable to a click jacking attack? I have also read that if the site is a forum base, then the ...
27
votes
2answers
4k views

Is Clickjacking a real security vulnerability?

As I understand it, this is how an attacker would exploit clickjacking: Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over ...
1
vote
3answers
149 views

Clickjacking on a site without user accounts

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not ...
2
votes
1answer
306 views

Protect against clickjacking but allow framing on domain?

I'd like to protect against clickjacking using the X-Frame-Options header, but we occasionally frame secure content on the insecure version of our site1: Since it looks like only Firefox currently ...
0
votes
1answer
110 views

When is it appropriate to provide clickjacking protection one of my websites pages?

I run a couple of websites, so I'm just wondering what is the appropriate use of clickjacking protection like the x-frame-options response header? What pages are susceptible to this kind of attack on ...
0
votes
1answer
189 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
2
votes
4answers
2k views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
13
votes
4answers
2k views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?
2
votes
1answer
2k views

How to prevent the following clickjacking attack?

The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
10
votes
2answers
3k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...