About this question
I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in that article, and I got the message “You’ve been clickjacked!” at the top of the page, indicating my web application is vulnerable to this type of attack:
To test whether a site is vulnerable to clickjacking, create an HTML page similar to the following, changing the URL highlighted in RED to point to your target site:
<html>
<head>
<title>Clickjack test page</title>
</head>
<body>
You’ve been clickjacked!
<iframe sandbox="allow-scripts allow-forms" src="http://localhost:8080" style="width:100%;height:90%"></iframe>
</body>
</html>
If you see the text “You’ve been clickjacked!” at the top of the page, your site is vulnerable.
How does that prove my website is vulnerable?
