Clickjacking
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-78abb7891633b1e8147b4e743e4f00af375d3cd6%252Fimage%2520%2848%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=ec3d7753&sv=1)
Use Trickest to easily build and automate workflows powered by the world's most advanced community tools. Get Access Today:
What is Clickjacking
Katika shambulio la clickjacking, mtumiaji anachukuliwa kuamini kuwa anaklik kipengele kwenye ukurasa wa wavuti ambacho ni bila kuonekana au kimejificha kama kipengele kingine. Manipulasi hii inaweza kusababisha matokeo yasiyokusudiwa kwa mtumiaji, kama vile kupakua malware, kuelekezwa kwenye kurasa za wavuti zenye uharibifu, kutoa akreditif au taarifa nyeti, uhamishaji wa pesa, au ununuzi wa bidhaa mtandaoni.
Prepopulate forms trick
Wakati mwingine inawezekana kujaza thamani ya maeneo ya fomu kwa kutumia vigezo vya GET wakati wa kupakia ukurasa. Mshambuliaji anaweza kutumia tabia hii kujaza fomu kwa data isiyo ya kawaida na kutuma payload ya clickjacking ili mtumiaji abonyeze kitufe cha Kutuma.
Populate form with Drag&Drop
Ikiwa unahitaji mtumiaji ajaze fomu lakini hutaki kumwambia moja kwa moja aandike taarifa maalum (kama barua pepe au nywila maalum unayojua), unaweza kumwambia tu Drag&Drop kitu ambacho kitaandika data unayodhibiti kama katika mfano huu.
Basic Payload
Malipo ya Hatua Nyingi
Drag&Drop + Click payload
XSS + Clickjacking
Ikiwa umepata shambulio la XSS linalohitaji mtumiaji kubonyeza kwenye kipengee fulani ili kuanzisha XSS na ukurasa ni hauna kinga dhidi ya clickjacking, unaweza kutumia hii kumdanganya mtumiaji kubonyeza kitufe/kiungo. Mfano: Umebaini self XSS katika maelezo binafsi ya akaunti (maelezo ambayo ni wewe pekee unaweza kuweka na kusoma). Ukurasa wenye fomu ya kuweka maelezo haya ni hauna kinga dhidi ya Clickjacking na unaweza kujaza fomu kwa vigezo vya GET. __Mshambuliaji anaweza kuandaa shambulio la Clickjacking kwa ukurasa huo ukijaza fomu kwa XSS payload na kumdanganya mtumiaji ku wasilisha fomu. Hivyo, wakati fomu inawasilishwa na thamani zimebadilishwa, mtumiaji atatekeleza XSS.
Mikakati ya Kupunguza Clickjacking
Ulinzi wa Upande wa Mteja
Scripts zinazotekelezwa upande wa mteja zinaweza kufanya hatua za kuzuia Clickjacking:
Kuhakikisha dirisha la programu ndilo dirisha kuu au la juu.
Kufanya fremu zote ziwe wazi.
Kuzuia bonyezo kwenye fremu zisizoonekana.
Kugundua na kuwajulisha watumiaji kuhusu jaribio la Clickjacking.
Hata hivyo, scripts hizi za kuvunja fremu zinaweza kupuuziliwa mbali:
Mipangilio ya Usalama ya Kivinjari: Baadhi ya vivinjari vinaweza kuzuia scripts hizi kulingana na mipangilio yao ya usalama au ukosefu wa msaada wa JavaScript.
HTML5 iframe
sandbox
Attribute: Mshambuliaji anaweza kuondoa scripts za kuvunja fremu kwa kuweka sifa yasandbox
na thamani zaallow-forms
auallow-scripts
bilaallow-top-navigation
. Hii inazuia iframe kuthibitisha ikiwa ni dirisha la juu, e.g.,
The allow-forms
and allow-scripts
values enable actions within the iframe while disabling top-level navigation. To ensure the intended functionality of the targeted site, additional permissions like allow-same-origin
and allow-modals
might be necessary, depending on the attack type. Browser console messages can guide which permissions to allow.
Server-Side Defenses
X-Frame-Options
The X-Frame-Options
HTTP response header informs browsers about the legitimacy of rendering a page in a <frame>
or <iframe>
, helping to prevent Clickjacking:
X-Frame-Options: deny
- Hakuna domain inayoweza kuweka maudhui kwenye fremu.X-Frame-Options: sameorigin
- Ni tovuti ya sasa pekee inayoweza kuweka maudhui kwenye fremu.X-Frame-Options: allow-from https://trusted.com
- Ni 'uri' iliyoainishwa pekee inayoweza kuweka ukurasa kwenye fremu.Kumbuka mipaka: ikiwa kivinjari hakikubali mwelekeo huu, huenda usifanye kazi. Kivinjari vingine hupendelea mwelekeo wa CSP frame-ancestors.
Content Security Policy (CSP) frame-ancestors directive
frame-ancestors
directive in CSP is the advised method for Clickjacking protection:
frame-ancestors 'none'
- KamaX-Frame-Options: deny
.frame-ancestors 'self'
- KamaX-Frame-Options: sameorigin
.frame-ancestors trusted.com
- KamaX-Frame-Options: allow-from
.
For instance, the following CSP only allows framing from the same domain:
Content-Security-Policy: frame-ancestors 'self';
Further details and complex examples can be found in the frame-ancestors CSP documentation and Mozilla's CSP frame-ancestors documentation.
Content Security Policy (CSP) with child-src
and frame-src
child-src
and frame-src
Content Security Policy (CSP) is a security measure that helps in preventing Clickjacking and other code injection attacks by specifying which sources the browser should allow to load content.
frame-src
Directive
frame-src
DirectiveDefines valid sources for frames.
More specific than the
default-src
directive.
Hii sera inaruhusu fremu kutoka chanzo sawa (mwenyewe) na https://trusted-website.com.
child-src
Mwelekeo
child-src
MwelekeoImeanzishwa katika kiwango cha CSP 2 kuweka vyanzo halali kwa wafanyakazi wa wavuti na fremu.
Inafanya kazi kama akiba kwa frame-src na worker-src.
Hii sera inaruhusu fremu na wafanyakazi kutoka chanzo kimoja (mwenyewe) na https://trusted-website.com.
Maelezo ya Matumizi:
Kuondolewa: child-src inatolewa polepole kwa ajili ya frame-src na worker-src.
Tabia ya Kurejelea: Ikiwa frame-src haipo, child-src inatumika kama kurejelea kwa fremu. Ikiwa zote hazipo, default-src inatumika.
Mwelekeo Mkali wa Chanzo: Jumuisha tu vyanzo vinavyotegemewa katika maagizo ili kuzuia unyakuzi.
JavaScript Frame-Breaking Scripts
Ingawa si salama kabisa, skripti za JavaScript zinazovunja fremu zinaweza kutumika kuzuia ukurasa wa wavuti usiweze kufanywa fremu. Mfano:
Kutumia Tokeni za Anti-CSRF
Uthibitishaji wa Tokeni: Tumia tokeni za anti-CSRF katika programu za wavuti ili kuhakikisha kwamba maombi yanayobadilisha hali yanafanywa kwa makusudi na mtumiaji na si kupitia ukurasa wa Clickjacked.
Marejeleo
![](https://book.hacktricks.xyz/~gitbook/image?url=https%3A%2F%2F3018635170-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FCtGnfY5n0YCGcWtBkgwe%252Fuploads%252Fgit-blob-78abb7891633b1e8147b4e743e4f00af375d3cd6%252Fimage%2520%2848%29.png%3Falt%3Dmedia&width=768&dpr=4&quality=100&sign=ec3d7753&sv=1)
Tumia Trickest kujenga na kujiendesha kiotomatiki kazi zinazotolewa na zana za jamii zilizoendelea zaidi duniani. Pata Ufikiaji Leo:
Jifunze & fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze & fanya mazoezi ya GCP Hacking:
HackTricks Training GCP Red Team Expert (GRTE)
Last updated