Clickjacking

Outline

Making the user click on something other than what he intended to.

For example, imagine an attacker who builds a web site that has a button on it that says "click here for a free iPod". However, on top of that web page, the attacker has loaded an iframe with your mail account, and lined up exactly the "delete all messages" button directly on top of the "free iPod" button. The victim tries to click on the "free iPod" button but instead actually clicked on the invisible "delete all messages" button.

Prevention

X-Frame-Options header prevents clickjacking. Also can be prevented using Content Security Policy.

CSRF Token Evasion

If a site has anti-CSRF tokens, then it might be possible to use clickjacking to evade them.