> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/exploitation/web/clickjacking.md).
# Clickjacking
> Clickjacking is a malicious technique of tricking a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects, including web pages.
>
> \-- [*Wikipedia*](https://en.wikipedia.org/wiki/Clickjacking)
* [PortSwigger - Web Security Academy - Clickjacking (UI redressing)](https://portswigger.net/web-security/clickjacking)
## Basic clickjacking attack
Just cover the target site by an overlay, like in follows. Or use Burp Suite's Clickbandit (`Burp` -> `Burp Clickbandit`).\
To prefill form data, just try appending params via url (GET).
```html
Click me
```
## Bypass frame detection
A common protection to avoid clickjacking is to try to detect, when a website is being framed.\
This can potentially be bypassed by using HTML5's `sandbox` iframe attribute, by specifing `allow-forms`, but omittin `allow-scripts` and `allow-top-navigation`.
```html
...