📖 What is Clickjacking?
Clickjacking is a malicious technique where an attacker uses transparent or opaque layers, usually iframes, to trick a user into clicking a button or link on another page when they intended to click on the top-level page. This can lead to unauthorized account changes.
"Look for the X-Frame-Options or Content-Security-Policy (CSP) headers in the exam; these are the primary defenses used to prevent clickjacking."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Clickjacking?
- ▸ UI Redressing involves manipulating the visual presentation of a webpage to trick users into performing actions they did not intend to execute.
- ▸ Attackers typically use transparent iframes to overlay a hidden target site on top of a decoy page, capturing clicks directed at the hidden layer.
- ▸ The X-Frame-Options header is a primary defense, using directives like DENY or SAMEORIGIN to prevent browsers from rendering a page in a frame.
- ▸ Content-Security-Policy (CSP) provides more granular control via the frame-ancestors directive, allowing specific trusted domains to embed the page while blocking others.
- ▸ Successful clickjacking requires a victim to interact with the page, making it a social engineering attack combined with a technical web vulnerability.
🎯 How does Clickjacking appear on the PT0-002 Exam?
You may be asked to identify the vulnerability when reviewing HTTP response headers and noticing the total absence of X-Frame-Options or Content-Security-Policy frame-ancestors directives during a web application assessment.
A scenario might describe an attacker creating a decoy website that embeds a target banking page in an invisible iframe to trick users into clicking a 'Transfer Funds' button unknowingly.
Expect questions where you must recommend the most modern and flexible mitigation strategy to prevent UI redressing across multiple trusted partner domains, specifically choosing the CSP frame-ancestors directive over X-Frame-Options.
❓ Frequently Asked Questions
How does clickjacking differ from Cross-Site Request Forgery (CSRF)?
While both trick users into performing actions, CSRF uses hidden requests sent from a different site, whereas clickjacking uses a visual overlay to trick the user into physically clicking a button.
Why is CSP's frame-ancestors directive preferred over the X-Frame-Options header?
CSP is more flexible because it allows a whitelist of multiple specific domains that can embed the page, whereas X-Frame-Options is limited to basic DENY or SAMEORIGIN options.
Can clickjacking be used to steal a user's password directly?
No, clickjacking is primarily used to trigger state-changing actions, like deleting an account. To steal passwords, an attacker would typically use XSS or a phishing page to capture keystrokes.