As I understand it, this is how an attacker would exploit clickjacking:
- Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over the HTML elements of my site.
- Send out phishing emails to get users to click on the link that goes to malicioussite.com rather than my site (or use some other technique to distribute the phishing link).
- Users enter data into or click on the malicious elements.
Savvy users would either not click the link, or notice that the address bar is incorrect. However, plenty of people would probably not notice.
My question is this: Can't the attacker achieve the same thing by using malicioussite.com as a reverse proxy? All the steps above would be the same, except that malicioussite.com would forward the requests to my site and then insert an extra
<script> tag in the HTML response to run the malicious code and add the malicious HTML elements. The
X-FRAME-OPTIONS header wouldn't help in that case because there are no frames (and the reverse proxy can strip it out anyway).
The attack relies on the user not checking the address bar, so if the attacker can implement the same attack in a different way that can't be defeated, why bother with
X-FRAME-OPTIONS or other clickjacking protections?