Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in that article, and I got the message “You’ve been clickjacked!” at the top of the page, indicating my web application is vulnerable to this type of attack:

To test whether a site is vulnerable to clickjacking, create an HTML page similar to the following, changing the URL highlighted in RED to point to your target site:

<html>
  <head>
    <title>Clickjack test page</title>
  </head>
  <body>
    <p>You’ve been clickjacked!</p>
    <iframe sandbox="allow-scripts allow-forms" src="http://localhost:8080" style="width:100%;height:90%"></iframe>
  </body>
</html>

If you see the text “You’ve been clickjacked!” at the top of the page, your site is vulnerable.

How does that prove my website is vulnerable?

share|improve this question
    
how to implement clickjacking on application? –  lakshmi Prudhvi Jul 1 '13 at 10:17
add comment

4 Answers

You allow the webpage to be framed from another domain than those under your control. Read the OWASP article on clickjacking.

There are two main ways to prevent clickjacking:

  1. Sending the proper browser response headers that instruct the browser to not allow framing from other domains
  2. Employing defensive code in the UI to ensure that the current frame is the most top level window

It proves that your application is frameable by other domains and hence, click-jackable.

share|improve this answer
add comment

Your webpage allows itself to be put inside an iframe.

An attacker can easily put your site in an iframe on his webpage, cleverly mask most of it, and trick the user into clicking a button there.

Because of CORS and CSRF tokens, usually websites under a different domain cannot spoof requests to your website. However, they can trick the user into clicking buttons (for example, the "logout" button.)

Read this OWASP page to learn how to protect against clickjacking

share|improve this answer
add comment

I tried http://google.com website in place of localhost you have up there and it still shows you have been clickjacked. I do not think seeing that message is the indication that your site is vulnerable. Rather if you see your webpage in iframe with that message means it is click jackable. Correct me if I am wrong.

share|improve this answer
    
The vulnerability is in that the website isn't protecting against being framed, as mentioned in the other answers. –  Xander Oct 8 '13 at 15:43
add comment

Happened to come across this question and figured I'd chip in to clarify what the problem is with that test. It's not really incorrect, but it only accounts for the clickjacking defense script that is mentioned on the page. It does not take into account the X-FRAME-OPTIONS header defense.

If you perform that test there are a couple of things that could happen:

  • The clickjack text disappears: This means that there is a javascript defense, and that there either is no header defense or your browser doesn't support it.
  • The clickjack text is still there but nothing is shown in the iframe: This means that there is a header defense, and your browser supports it. You can't tell if the javascript defense is implemented because the iframe page is never loaded.
  • The clickjack text is still there, and the site loaded in the iframe: This means that there is no javascript defense, and that there either is no header defense or your browser doesn't support it.

As the second options shows, the page can be properly protected but you still see the clickjack text. To be sure, it's probably best to perform the test with both a modern and older browser without X-FRAME-OPTIONS support.

Naturally, both defenses should be implemented. The header defense is aimed towards modern browsers, while the javascript defense protects legacy browsers.

Check out https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet for more information.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.