1

Came across this question in SE How does this test prove my application is vulnerable to clickjacking attacks? I have a follow-up question and doubt, please help me to clear it.

As per https://www.owasp.org/index.php/Testing_for_Clickjacking_(OTG-CLIENT-009)

<html>
   <head>
     <title>Clickjack test page</title>
   </head>
   <body>
     <p>Website is vulnerable to clickjacking!</p>
     <iframe src="http://www.target.site" width="500" height="500"></iframe>
   </body>
</html>

its says

Result Expected: If you can see both the text "Website is vulnerable to click jacking!" at the top of the page and your target web page successfully loaded into the frame, then your site is vulnerable and has no type of protection against Click jacking attacks. Now you can directly create a "proof of concept" to demonstrate that an attacker could exploit this vulnerability.

So if text is only displayed and the site is not successfully loaded, does that mean the site is not vulnerable ?

2

For Click jacking to occur the site should be fully loaded in the frame,only then click jacking is possible,which means you can successfully load the attacker's website into the victim's webpage in which he is currently using.

So if text is only displayed and the site is not successfully loaded, does that mean the site is not vulnerable ?

If the text is displayed and the site is not successfully loaded then there is no click jacking vulnerability

  • Still some doubt persists, as different sites say different things. For eg, as per this site, it is vulnerable if text is displayed. codemagi.com/blog/post/196 – Rndp13 Nov 19 '15 at 11:15
  • As per this site if you can see both the text and the target web page successfully loaded into the frame, then your site is vulnerable to click jacking attack – Bhuvanesh Nov 19 '15 at 11:33
  • The codemagi's excerpt you linkedis wrong. If take a look at the html code they provided, the text that says you've been clickjacked is in a <p> tag that has no relation to the iframe where the website should be loaded. Therefore, that text will always be shown, even if the website is not vulnerable to clickjacking. So, in any proof-of-concept code you ever see, the website will only be vulnerable if it is actually displayed inside the iframe. – DarkLighting Nov 19 '15 at 12:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.