Scenario: 1. Victim opens the attacker's web site. 2. Attacker sets up a web site which contains interesting and attractive content like 'Do you want to make $1000 in a day?'. 3. Victim clicks to the

Session Fixation forces a victim to authenticate using a pre-set session token controlled by the attacker - it does not involve iframe overlays or click interception.

HTML Injection inserts unsanitized HTML markup into a web page to alter its content or structure, not to overlay invisible iframes and intercept user clicks.

HTTP Parameter Pollution manipulates duplicate HTTP parameters to bypass input filters or cause inconsistent server behavior, and is unrelated to visual overlay techniques.

Clickjacking, also called a UI redress attack, works by rendering a transparent iframe over a page element the victim intends to click, so the actual click is registered by the hidden iframe content instead. The attacker lures the victim with engaging bait content and harvests the click to perform unintended actions such as authorizing transactions or changing account settings. The transparent iframe is the defining technical mechanism of this attack.