Clickjacking is an attack where the attacker overlays their own UI over a web page, "hijacking" the clicks that the victim makes on the page.

Clickjacking, also called a "UI redress attack", is an attack where the attacker hijacks the clicks that a user makes.

The attacker loads their own page in a transparant layer over the actual page. The clicks that are meant for the actual page are then redirected - they are hijacked. Thus, it is possible for a user to be genuinely authenticated on the actual page, but the attacker can intercept the actions that the user makes on the actual page and redirect them as he desires.

As a concrete example, it was possible to make people "like" something on Facebook without them knowing it using this attack. This was called "likejacking" (Facebook has since addressed the issue).

Sources and further reading:
OWASP page on Clickjacking
Wikipedia page on Clickjacking

history | excerpt history