Question

Clickjacking , or user-interface redressing, is an attack that tricks users into clicking a malicious button that has been made to look legitimate. Attackers achieve this by using HTML page-overlay techniques to hide one web page within another. Let’s discuss this fun-to-exploit vulnerability, why it’s a problem, and how you can find instances of it.

点击劫持或用户界面伪装是一种攻击，会欺骗用户点击一个看起来合法的恶意按钮。攻击者通过使用 HTML 页面覆盖技术将一个网页隐藏在另一个网页中来实现这一目的。让我们探讨一下这个有趣而易于利用的漏洞，为什么它是一个问题，以及您如何找到它的实例。

Note that clickjacking is rarely considered in scope for bug bounty programs, as it usually involves a lot of user interaction on the victim’s part. Many programs explicitly list clickjacking as out of scope, so be sure to check the program’s policies before you start hunting! However, some programs still accept them if you can demonstrate the impact of the clickjacking vulnerability. We will look at an accepted report later in the chapter.

请注意，点击劫持通常需要受害者进行大量交互，因此很少被视为漏洞赏金计划的范围内。许多计划明确将点击劫持列为超范围，因此在开始寻找之前，请务必检查计划的政策！然而，如果您能够证明点击劫持漏洞的影响，某些计划仍会接受它们。我们将在本章后面查看一份被接受的报告。