1

Came across this question in SE How does this test prove my application is vulnerable to clickjacking attacks? I have a follow-up question and doubt, please help me to clear it.

As per https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)

<html>
   <head>
     <title>Clickjack test page</title>
   </head>
   <body>
     <p>Website is vulnerable to clickjacking!</p>
     <iframe src="http://www.target.site" width="500" height="500"></iframe>
   </body>
</html>

its says

Result Expected: If you can see both the text "Website is vulnerable to click jacking!" at the top of the page and your target web page successfully loaded into the frame, then your site is vulnerable and has no type of protection against Click jacking attacks. Now you can directly create a "proof of concept" to demonstrate that an attacker could exploit this vulnerability.

So if text is only displayed and the site is not successfully loaded, does that mean the site is not vulnerable ?

Improve this question

1 Answer 1

Reset to default
2

For Click jacking to occur the site should be fully loaded in the frame,only then click jacking is possible,which means you can successfully load the attacker's website into the victim's webpage in which he is currently using.

So if text is only displayed and the site is not successfully loaded, does that mean the site is not vulnerable ?

If the text is displayed and the site is not successfully loaded then there is no click jacking vulnerability

Improve this answer
3
  • Still some doubt persists, as different sites say different things. For eg, as per this site, it is vulnerable if text is displayed. codemagi.com/blog/post/196
    – Rndp13
    Commented Nov 19, 2015 at 11:15
  • As per this site if you can see both the text and the target web page successfully loaded into the frame, then your site is vulnerable to click jacking attack
    – Bhuvanesh
    Commented Nov 19, 2015 at 11:33
  • The codemagi's excerpt you linkedis wrong. If take a look at the html code they provided, the text that says you've been clickjacked is in a <p> tag that has no relation to the iframe where the website should be loaded. Therefore, that text will always be shown, even if the website is not vulnerable to clickjacking. So, in any proof-of-concept code you ever see, the website will only be vulnerable if it is actually displayed inside the iframe.
    – DarkLighting
    Commented Nov 19, 2015 at 12:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .