3

Most of the examples I have read start with a malicious website. Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking? Can this occur without a XSS vulnerability or without my server being compromised? If so, how?

5

By default, any new website is probably vulnerable to Clickjacking, depending on the webserver defaults.

For defense against it, you should set HTTP-Response-Headers, as the OWASP Clickjacking Defense Cheat Sheet recommends. Another valuable and more concise ressource is Wikipedia:

Disallow embedding: All iframes etc. will be blank, or contain a browser specific error page.

Content-Security-Policy: frame-ancestors 'none'

X-Frame-Options: deny

Allow embedding of own content only:

Content-Security-Policy: frame-ancestors 'self'

X-Frame-Options: sameorigin

Allow specific origins to embed this content :

Content-Security-Policy: frame-ancestors www.example.com www.wikipedia.org

X-Frame-Options: ALLOW-FROM www.example.com www.wikipedia.org

Most examples start with a malicious website, because an attacker will require this malicious website for his attack on your vulnerable website: He can simply create his own evil.com website, containing an iframe of your victim.org.

As long as victim.org does not prevent the attacker from doing so, victim.org will remain vulnerable to Clickjacking.

  • 1
    I was going to answer but you're 2fast4me! A useful link I was going to include that might be a useful addition (not as long-winded as owasp): en.wikipedia.org/wiki/Clickjacking#Server-side – Luc Mar 12 at 14:27
  • Sorry, @Luc :) Nice resource. I added it as well. :) – Euphrasius von der Hummelwiese Mar 12 at 14:31
  • Thanks for the answer and +1. I'm holding off on accepting this answer though because my understanding is that the attacker would have to load an iframe onto my website and trick users. How could this be possible without a compromised server or XSS vulnerability? – The Gilbert Arenas Dagger Mar 12 at 14:33
  • He can in fact place the iframe everywhere he likes, even on foreign domains, that are controlled by the attacker. If he can do so on your site, you will probably have more issues then just clickjacking. I updated my answer accordingly. – Euphrasius von der Hummelwiese Mar 12 at 14:42
  • Got it. So by permitting my website to be contained in an iFrame allows the potential for my users to unknowingly perform some action against my site. Thanks for clarifying your answer. – The Gilbert Arenas Dagger Mar 12 at 14:57
1

Most of the examples I have read start with a malicious website.

In a clickjacking attack, a malicious website tricks the user to click on something on the target website. The target website is the one vulnerable to clickjacking.

Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking?

It has to have authentication. Clickjacking is tricking someone else to click on something. The point is that the victim is logged in to the target website. The action performed on the click is only available for authorized users, otherwise the attacker could just go to the site and click it himself.

It has to have a click target that performs an impactful action at once. The victim can be tricked to click once or twice, but more complex user interaction is hard to perform.

The most common form of clickjacking works by rendering the target site in an iframe, which some HTTP headers can prevent. However, clickjacking can also be performed by quickly switching windows or sites. So preventing your site from being loaded in an iframe does not necessarily block all clickjacking attacks.

Can this occur without a XSS vulnerability or without my server being compromised? If so, how?

Yes. Your site is loaded in a transparent iframe in front of a malicious site. The malicious site tricks the user to click somewhere ("click here to view cute cat pictures") and unknowingly the user clicks on the target site.

Actual clickjacking attacks are rare, except on high-profile sites where everybody is logged in all the time and there are straightforward click targets. So Facebook likes and Twitter retweets are common targets for clickjacking attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.