Which technique overlays a legitimate page on top and uses an invisible iframe with a higher z-index?

Which technique overlays a legitimate page on top and uses an invisible iframe with a higher z-index?

• A. Cropping
• B. DNS Interrogation
• C. WAFW00F
• D. Complete Transparent Overlay

Answer: (D)

This is all about clickjacking through a transparent, layered overlay. In this technique, a legitimate page is shown to the user, but an invisible iframe is placed on top with a higher z-index. The user interacts with the overlay, while the real actions are actually performed by the hidden page underneath. The result is that clicks or inputs appear to be on the visible page, but they affect the behind-the-scenes page or controls, enabling actions the user didn’t intend. This approach relies on the overlay being transparent or nearly so, and on positioning it to cover the target UI element. Defenses include headers like X-Frame-Options or Content-Security-Policy frame-ancestors to prevent embedding, frame-busting techniques, and requiring explicit user confirmation for sensitive actions. The other options describe unrelated concepts: cropping involves altering an image, DNS interrogation is about gathering domain information, and WAFW00F is a tool for fingerprinting web application firewalls.

This is all about clickjacking through a transparent, layered overlay. In this technique, a legitimate page is shown to the user, but an invisible iframe is placed on top with a higher z-index. The user interacts with the overlay, while the real actions are actually performed by the hidden page underneath. The result is that clicks or inputs appear to be on the visible page, but they affect the behind-the-scenes page or controls, enabling actions the user didn’t intend.

This approach relies on the overlay being transparent or nearly so, and on positioning it to cover the target UI element. Defenses include headers like X-Frame-Options or Content-Security-Policy frame-ancestors to prevent embedding, frame-busting techniques, and requiring explicit user confirmation for sensitive actions.

The other options describe unrelated concepts: cropping involves altering an image, DNS interrogation is about gathering domain information, and WAFW00F is a tool for fingerprinting web application firewalls.