What is Clickjacking?

👩‍🎓👨‍🎓 Learn about Clickjacking vulnerabilities. In this video, we are going to see an example of what it is and how a victim would fall for it!

Overview:
00:00 Intro
00:16 Lab overview
01:16 What is an iframe?
02:19 Cascading Style Sheets
03:14 Crafting the payload
04:55 Solving the lab!
05:35 Conclusion

---

[fastexpand]

You made this so easy to understand! Not just the attack but how to actually perform it! Well done and thank you!

[WithSandra]

Very helpful explanation, thank you! :)

[rexlei]

The iframe seems not carring the cookies of browser.
I need to login again in the iframe when viewing the exploit, am I doing something wrong?
Thx!

[nerdisyumyum]

it looks so easy but my screen keeps going to the log in screen instead of staying on the my account screen when i put my account id in the exploit server body?

[prof.angelinagokhale]

Excellent tutorial! Thank you very much :D

[manmoon]

Are there any programs on platform which still accept clickjacking? I doubt so.

[temeturs]

This worked just fine on Firefox. Can't you use the source code to alter the attack and foil the attacker the same way as in the lab? Thanks a bunch It made the lab easy!

[Norman-rz]

my lab id shows the login button rather the update and delete button..what may be the problem

[jamesrobertson]

In both Chrome or Firefox I do not manage to modify the height of the iFrame, it stays at about 100px, and a scrollbar appears on the right. Hence I never can align the div...

[satwiksv]

How does the user goes to that exlpoited page, will he click any button, i don't understand can you please explain 😢😢, do the user know that he is deleting his account

[shinobix]

Thanks for the tutorial! Do you think people need to know web development to understand clickjacking?

[julianjulian]

Your explanation is too good a new sub added god bless you brother and can explain the please Lab: CORS vulnerability with internal network pivot attack like what are the 4 scripts are and how it works

[arshiaalidosti]

Thank you, but I did all the same things but the state would not change to solved!

[mustang...]

Oh my god, this lab is the worst.
It says: "To solve the lab, craft some HTML that frames the account page and fools the user into deleting their account. The lab is solved when the account is deleted."
I created the page locally and a fake button that wraps the iframe exactly above the delete button, so that this fake button can be placed anywhere not just at the exact position like in this video. Still after deleting the account (as mentioned in the task), the solution says that I shouldn't have deleted it ))

[fahadfaisal]

Why always every one out of scope text injection? 😭

[crimson]

I subscribed after I heard his voice. LOL

[zzzzzzzzZzZZzzzaZzz]

Does this fall under social engineering?

[lethalleet]

Clickjacking is commenting first like me