Clickjacking Simulator
An invisible iframe sits on top of a fake game button. See exactly how a real click lands on a hidden "delete account" button instead.
An invisible frame sits over a fake game button. You think you are clicking Play; the click lands on "delete account" in a framed page where you are still logged in. Seeing it once makes the defence obvious.
How to use it
- Click the visible button.
- Reveal the transparent frame above it.
- See where the click actually landed.
What to take away
Nothing is forged
The victim really clicked, really authenticated, really authorised it. Only the intent was stolen — which is why server-side checks cannot detect it.
Framing controls are the fix
X-Frame-Options: DENY, or the modern CSP frame-ancestors directive, tells the browser not to allow framing at all.
Frequently asked questions
How do I stop clickjacking?
Send Content-Security-Policy: frame-ancestors 'none' (or an explicit allowlist). X-Frame-Options is the older equivalent and still worth sending for legacy clients.
What is likejacking?
The same technique aimed at social media buttons, harvesting likes, follows and shares from users who thought they clicked something else.
Where this fits in the course
This security lab pairs with Path 11 — Web Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
- Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.
- Vulnerable Web App — A tiny deliberately-broken app for practicing XSS and login-bypass. Runs entirely in-browser; no server to attack, nothing to install.
- Open Redirect Playground — A login page trusts a returnUrl parameter completely. Turn a genuinely trusted link into a post-login phishing weapon.