This has something to do with a different post I made: Other post
While researching this a bit further I found the following blogpost: blog elev
As I understand it this guy reads all content of a website and then displays it in his iframe. This way the x-frame-options is circumvented and the site can be displayed. He uses this functional to test something or the other.
This got met thinking about the security implications of this.
Consider the following scenario:
- I have a site with a login page and I set the x-frame-options to SAMEORIGIN as I do not want to be vulnerable to clickjacking attacks
- An attacker makes a site as in the blogpost and puts all content of my site into an iframe like reported in the blogpost. He then puts an invisible iframe on top of that, which he will use to gather whatever the users will put into the login form.
- An attacker then tricks a user to click on his link to a site that has an url similar to mine (e.g. mys1te.com).
- The user thinks it is my site and logs in
- The attacker has the credentials of the user
Isn't this a clickjacking attack? And if so isn't this then a way to bypass the x-frame-options? And then if so, what can be used to make a 100% sure no clickjacking is possible?
I am trying to find the holes in this story.