SEED Labs - Clickjacking Lab 1 Clickjacking Copyright © 2021 by Collin Howland, Faith Letzkus, Julio Trujillo, and Steve Cole at Washington University in St. Louis. This work is licensed under

a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License. If you remix, transform, or build upon the material, this copyright notice must be left intact, or reproduced in a way that is reasonable to the medium in which the work is being re-published. Overview Clickjacking, also known as a “UI redress attack," is an attack that tricks a user into clicking on something they do not intend to when visiting a webpage, thus "hijacking" the click. In this lab, we will explore a common attack vector for clickjacking: the attacker creates a webpage that loads the content of a legitimate page but overlays one or more of its buttons with invisible button(s) that trigger malicious actions. When a user attempts to click on the legitimate page's buttons, the browser registers a click on the invisible button instead, triggering the malicious action. Example scenario. Suppose an attacker acquires the domain starbux.com and creates a website with that URL. The site first loads the legitimate target website starbucks.com in an iframe element span- ning the entire webpage, so that the malicious starbux.com website looks identical to the legitimate starbucks.com website. The attacker's site then places an invisible button on top of the 'Menu' but- ton on the displayed starbucks page; the button triggers a 1-click purchase of the attacker's product on Amazon. If the user is logged on to Amazon when they try to click the legitimate button, the inadvertent click on the invisible button will make the unintended purchase without the user's knowledge or consent. Topic coverage. This lab covers the following topics: