closed as too broad by Steffen Ullrich, Polynomial, Xander, Jeroen, Overmind Mar 21 at 6:41
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Stealing information is not easily possible and not what Clickjacking is really about.
Clickjacking is functionally similar to CSRF, in that you can perform actions on the site across origins, but you cannot retrieve information.
With Clickjacking, you can perform any click actions, and potentially also enter text by dragging it into the iframe (depending on the browser). But you cannot drag text out of the iframe, because the same origin policy prevents that.
I know we can use Ctrl+C for copying leaking text on web page and Ctrl+V for pasting the copied token on the input box for hijacking.
That's a neat idea, but it requires some unlikely user interaction.
For a quick example, consider this:
// attacker.com/clickjack.html <div style="position: absolute; left: 10px; top: 10px; pointer-events: none;">Copy this (double click -> CTRL+C)</div> <iframe style="opacity: 0;" height="100" width="100" scrolling="no" src="http://example.com/steal.html"></iframe> <input type="text" placeholder="to here (CTRL+V)" oninput="alert('stolen: ' + this.value)"> // example.com/steal.html secret
For a successful attack, a user would need to double-click on the upper-left of the page (certainly doable), press CTRL+C (unlikely), select the input, and press CTRL+V (also unlikely).
This would also only work in Firefox, as Chrome doesn't allow selecting invisible text.
There shouldn't be any way to steal source code this way (you can't use
view-source:... as a src in an iframe)