Clickjacking - Revision history

Neil Smithline: /* References */ added Mozilla's CSP/frame-ancestors

2017-12-21T21:16:19Z

‎References: added Mozilla's CSP/frame-ancestors

2017-12-21T21:04:50Z

updated with CSP defense

2017-02-25T11:14:43Z

‎References

2015-12-01T11:53:24Z

‎References

2015-12-01T11:50:33Z

‎References

2015-12-01T11:49:28Z

‎References

2014-08-28T00:18:12Z

Grammar Fix.

2014-08-26T22:40:12Z

Removing previous editing artifact.

2014-04-05T19:39:42Z

‎Defending against Clickjacking

2014-02-16T07:44:37Z

@@ Line 23: / Line 23: @@
 * [https://www.linkedin.com/pulse/20141202104842-120953718-why-am-i-anxious-about-clickjacking Why am I anxious about Clickjacking?]
 :  A Basic understanding of Clickjacking Attack
 * https://developer.mozilla.org/en-US/docs/The_X-FRAME-OPTIONS_response_header
-: Mozilla developer resource on The X-Frame-Options response header.
+: Mozilla developer resource on the X-Frame-Options response header.
 * [http://w2spconf.com/2010/papers/p27.pdf Busting Frame Busting: A study of clickjacking vulnerabilites on top sites]

@@ Line 15: / Line 15: @@
 = Defending against Clickjacking =
 There are two main ways to prevent clickjacking:
-# Sending the proper X-Frame-Options HTTP response headers that instruct the browser to not allow framing from other domains
+# Sending the proper Content Security Policy (CSP) frame-ancestors directive response headers that instruct the browser to not allow framing from other domains. (This replaces the older X-Frame-Options HTTP headers.)
 # Employing defensive code in the UI to ensure that the current frame is the most top level window

@@ Line 21: / Line 21: @@
 = References =
 * https://developer.mozilla.org/en-US/docs/The_X-FRAME-OPTIONS_response_header
 : Mozilla developer resource on The X-Frame-Options response header.

← Older revision		Revision as of 11:53, 1 December 2015
Line 35:		Line 35:
	* [[ClickjackFilter_for_Java_EE\|Anti-clickjacking J2EE filter]]		* [[ClickjackFilter_for_Java_EE\|Anti-clickjacking J2EE filter]]
	: A simple J2EE servlet filter that sends anti-framing headers to the browser.		: A simple J2EE servlet filter that sends anti-framing headers to the browser.
−
−	* [https://www.owasp.org/index.php/OWASP_Click_Me_Project Creating test page for Clickjack vulnerability]
−	~~: A tool to create test pages to check for clickjacking~~

@@ Line 36: / Line 36: @@
 : A simple J2EE servlet filter that sends anti-framing headers to the browser.
-* [https://www.owasp.org/index.php/OWASP_Click_Me_Project : Creating test page for Clickjack vulnerability]
+* [https://www.owasp.org/index.php/OWASP_Click_Me_Project Creating test page for Clickjack vulnerability]
 : A tool to create test pages to check for clickjacking

← Older revision		Revision as of 11:49, 1 December 2015
Line 35:		Line 35:
	* [[ClickjackFilter_for_Java_EE\|Anti-clickjacking J2EE filter]]		* [[ClickjackFilter_for_Java_EE\|Anti-clickjacking J2EE filter]]
	: A simple J2EE servlet filter that sends anti-framing headers to the browser.		: A simple J2EE servlet filter that sends anti-framing headers to the browser.
		+
		+	* [https://www.owasp.org/index.php/OWASP_Click_Me_Project : Creating test page for Clickjack vulnerability]
		+	: A tool to create test pages to check for clickjacking

@@ Line 11: / Line 11: @@
 Clickjacking also made the news in the form of a [http://shiflett.org/blog/2009/feb/twitter-dont-click-exploit Twitter worm]. This clickjacking attack convinced users to click on a button which caused them to re-tweet the location of the malicious page, and propagated massively.
-There has also been clickjacking attacks abusing Facebook's "Like" functionality. [http://threatpost.com/en_us/blogs/facebook-jacking-scams-expand-060310 Attackers can trick logged-in Facebook users to arbitrarily like fan pages, links, groups, etc]
+There have also been clickjacking attacks abusing Facebook's "Like" functionality. [http://threatpost.com/en_us/blogs/facebook-jacking-scams-expand-060310 Attackers can trick logged-in Facebook users to arbitrarily like fan pages, links, groups, etc]
 = Defending against Clickjacking =

← Older revision		Revision as of 22:40, 26 August 2014
Line 1:		Line 1:
−	Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to ~~other~~ another page, most likely owned by another application, domain, or both.	+	Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.

	Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.		Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of stylesheets, iframes, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.