Clickjacking WAHS Practice Questions (Page 8)

Questions 36–38

1. 36application · medium

   A web developer is reviewing a colleague's code for a new payment page. The developer wants to manually verify whether the page is vulnerable to clickjacking before deployment. Using the browser's developer tools, which inspection step would most directly confirm the vulnerability?

   • AIn the Application tab, review the cookies set by the page to see if the HttpOnly flag is set.
   • BIn the Network tab, check if the response headers include 'X-Frame-Options' or 'Content-Security-Policy: frame-ancestors'.
   • CIn the Elements tab, check if the page contains any iframe elements.
   • DIn the Console tab, look for JavaScript errors that occur when the page is loaded.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A security analyst is investigating a sophisticated clickjacking attack. The attacker's page uses an iframe to load a target application, but the iframe is not transparent. Instead, the attacker uses a CSS technique to make the iframe's content appear as a legitimate part of the attacker's page, such as a fake login form. The user interacts with the iframe's content, believing it is part of the attacker's page. What is this attack vector called?

   • AThis is a cross-site scripting (XSS) attack because the attacker is injecting content from another origin into their page.
   • BThis is a phishing attack because the attacker is presenting a fake login form.
   • CThis is a variation of clickjacking known as 'likejacking' or 'UI redressing', where the attacker visually integrates the iframe's content into the page to deceive the user.
   • DThis is a man-in-the-middle (MITM) attack because the attacker is intercepting the user's interaction with the target application.
   Reveal Solution Discussion Select an answer first
3. 38foundation · easy

   Which browser developer tool feature is most useful for manually detecting clickjacking?

   • AThe Application tab to view local storage
   • BThe Network tab to view HTTP response headers
   • CThe Console tab to view JavaScript errors
   • DThe Performance tab to measure page load time
   Reveal Solution Discussion Select an answer first