Clickjacking is an attack where the attacker overlays their own UI over a web page, "hijacking" the clicks that the victim makes on the page.

learn more… | top users | synonyms

1
vote
1answer
51 views

Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)

X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a ...
3
votes
1answer
73 views

How to “deliver” a clickjacking attack?

How can a hacker deliver a clickjacking attack? Does the hacker need to manipulate a "good.com" website and change its original code? Does the hacker create an "evil.com" website and just put a ...
2
votes
1answer
76 views

Is the Framekiller really safe against clickjacking?

I am using this code. In the header section of the page, this CSS rule: html{display:none;} And then this javascript: if (self == top) document.documentElement.style.display = 'block'; else ...
3
votes
2answers
73 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
0
votes
1answer
39 views

Setting certain response headers only if Referer is invalid

I came across this technique and I'm curious if there are any flaws in this design. A site sets the X-Frame-Options response header to deny only if the Referer header is not define or does not match ...
0
votes
1answer
57 views

If the site is not loaded in the frame, is the site vulnerable to click jacking.

Came across this question in SE How does this test prove my application is vulnerable to clickjacking attacks? I have a follow-up question and doubt, please help me to clear it. As per ...
1
vote
2answers
77 views

should one use “framekiller” code avoid others embedding https pages in iframes?

I found various discussions about https being embedded in iframes for various reasons. I tested it and saw that one bank site escapes the iframe and the other allows being embedded in an iframe. ...
1
vote
2answers
129 views

How to set X-FRAME-OPTIONS where 3rd Party frame is required to be loaded?

We have set the set X-Frame-Options in the header as ALLOW-FROM same origin but there is a requirement to open below page from some 3rd party website. Do you see security issue here? HTTP::header ...
7
votes
1answer
190 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
4
votes
2answers
300 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
3
votes
2answers
501 views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there ...
1
vote
4answers
195 views

how can this prove a clickjacking vulnerability?

How does just putting a site link in an iframe (and when opens in iframe) indicate that the site is vulnerable to a click jacking attack? I have also read that if the site is a forum base, then the ...
28
votes
2answers
5k views

Is Clickjacking a real security vulnerability?

As I understand it, this is how an attacker would exploit clickjacking: Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over ...
1
vote
3answers
282 views

Clickjacking on a site without user accounts

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not ...
3
votes
1answer
728 views

Protect against clickjacking but allow framing on domain?

I'd like to protect against clickjacking using the X-Frame-Options header, but we occasionally frame secure content on the insecure version of our site1: Since it looks like only Firefox currently ...
0
votes
1answer
141 views

When is it appropriate to provide clickjacking protection one of my websites pages?

I run a couple of websites, so I'm just wondering what is the appropriate use of clickjacking protection like the x-frame-options response header? What pages are susceptible to this kind of attack on ...
0
votes
1answer
223 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
2
votes
4answers
3k views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
12
votes
4answers
2k views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?
2
votes
1answer
3k views

How to prevent the following clickjacking attack?

The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
10
votes
2answers
3k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...