Clickjacking

Definitions

1. An attack where a malicious site loads a target site in a transparent iframe positioned over a decoy UI, tricking users into clicking buttons on the hidden site (e.g., 'Delete Account' or 'Transfer Funds'). Prevented by the X-Frame-Options header (DENY or SAMEORIGIN) or Content-Security-Policy frame-ancestors directive.

   In plain English: Tricking users into clicking hidden buttons on a real website by covering it with a fake page.

   Example: "The attacker overlaid our banking app in a transparent iframe — users thought they were clicking a game button but were actually approving transfers."

Related Terms

• Privilege Escalation
• CORS Preflight
• Content Security Policy
• HSTS
• Dependency Confusion
• Security Headers
• IDOR
• Supply Chain Security