Clickjacking
Fooling users to click something they didn't mean to, such as an invisible frame
that is covering the actual button/link/etc. that they indend to click.
ie: have a from that deletes all their mail when clicked
retweets malicious link to everybody
There are two main ways to prevent clickjacking:
*Sending the proper X-Frame-Options HTTP response headers that instruct the browser
to not allow framing from other domains
*Employing defensive code in the UI to ensure that the current frame is the most top level window
to test:
Clickjack test page
Website is vulnerable to clickjacking!