UI Redressing is a Clickjacking technique where an attacker overlays a transparent UI element on top of a legitimate website or application. The transparent UI element contains malicious content or actions that are visually hidden from the user. By manipulating the transparency and positioning of elements, the attacker can trick the user into interacting with the hidden content, believing they are interacting with the visible interface. * **How UI Redressing Works:** * Overlaying Transparent Element: The attacker creates a transparent HTML element (usually a `<div>`) that covers the entire visible area of a legitimate website. This element is made transparent using CSS properties like `opacity: 0;`. * Positioning and Layering: By setting the CSS properties such as `position: absolute; top: 0; left: 0;`, the transparent element is positioned to cover the entire viewport. Since it's transparent, the user doesn't see it. * Misleading User Interaction: The attacker places deceptive elements within the transparent container, such as fake buttons, links, or forms. These elements perform actions when clicked, but the user is unaware of their presence due to the overlaying transparent UI element. * User Interaction: When the user interacts with the visible interface, they are unknowingly interacting with the hidden elements due to the transparent overlay. This interaction can lead to unintended actions or unauthorized operations.
<div style="opacity: 0; position: absolute; top: 0; left: 0; height: 100%; width: 100%;">
<a href="malicious-link">Click me</a>
</div>Source: Clickjacking/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.