Scenario1: 1. Victim opens the attacker's web site. 2. Attacker sets up a web site which contains interesting and attractive content like 'Do you want to make $1000 in a day?'. 3. Victim clicks to…

Question

Options

• ASession Fixation
• BHTML Injection
• CHTTP Parameter Pollution
• DClickjacking Attack

• A
  4% (1)
• C
  4% (1)
• D
  93% (26)

Explanation

Clickjacking Attack Explained

Option D is correct because the scenario perfectly describes a Clickjacking attack (also called UI Redress Attack), where an attacker overlays a transparent iframe over legitimate-looking content, tricking the victim into clicking something different from what they intended - in this case, unknowingly interacting with the hidden malicious frame.

Why the distractors are wrong:

• A (Session Fixation): This attack forces a user to use a predetermined session ID to hijack their authenticated session - no iframes or UI deception involved.
• B (HTML Injection): This involves injecting malicious HTML code into a vulnerable web page to manipulate its content, not overlaying invisible frames.
• C (HTTP Parameter Pollution): This attack manipulates web application logic by injecting duplicate HTTP parameters - entirely unrelated to UI manipulation.

Memory Tip: Think of "Clickjacking" literally - the attacker is "jacking" (hijacking) your click by placing an invisible layer over what you think you're clicking. If you remember "invisible iframe + stolen click = Clickjacking," you'll never confuse it with the others.

No community discussion yet for this question.