In browser-security-model you met two names in passing - X-Frame-Options and the Content Security Policy (CSP) directive frame-ancestors. This lesson is where they earn their keep.
Clickjacking - also called UI redressing - is an attack you literally cannot see:
A malicious page loads a legitimate application inside an invisible frame and tricks you into clicking something you never meant to touch. You think you are clicking the attacker's page; your click actually lands on the real, logged-in target underneath.
Picture a page that says "Click here to win". Beneath that button, made fully transparent, sits a frame of your bank's Transfer funds page - already authenticated with your session. You click the prize; the browser delivers the click to the hidden Confirm transfer button. The attacker re-dressed the target's interface with their own facade. That is the "redressing" in UI redressing.
What makes this one special is its root cause. The application's code can be flawless and the site can still be exploitable - purely because a response is missing a header. That is why it lives under Security Misconfiguration: there is nothing to fix in the business logic, only a deployment-time setting that tells browsers "never let another origin frame me."
A question you should be asking: doesn't the same-origin policy stop this? No - and that gap is the whole point. The same-origin policy stops the attacker's script from reading a cross-origin frame, but it does not stop the frame from being displayed, and it does not stop your click from passing through. Clickjacking needs neither to read nor to script the frame - only your genuine click on a control you can see.
In this lesson you will:
- Inspect a prebuilt framing page - an
<iframe>pointing at an inert target plus a transparent overlay - in the custom PoC Builder. - Submit that iframe proof-of-concept as your finding.
- Compare simulated vulnerable and protected outcomes to learn which header - **
X-Frame-Optionsor CSPframe-ancestors** - stops the frame from ever rendering, and howSameSitecookies back it up.
Estimated time: eight to twelve minutes.
Prerequisites: browser-security-model for Same-Origin Policy (SOP) and CSP.
Everything interactive is contained in the custom page; no local HTML file, local target, or separate browser tab is required.
When you are ready, send the Continue signal.