11

I want to know more about clickjacking. I have been reading an article about clickjacking, where the HTML code to test for clickjacking vulnerability was provided. I tried the same as described in that article, and I got the message “You’ve been clickjacked!” at the top of the page, indicating my web application is vulnerable to this type of attack:

To test whether a site is vulnerable to clickjacking, create an HTML page similar to the following, changing the URL highlighted in RED to point to your target site:

<html>
  <head>
    <title>Clickjack test page</title>
  </head>
  <body>
    <p>You’ve been clickjacked!</p>
    <iframe sandbox="allow-scripts allow-forms" src="http://localhost:8080" style="width:100%;height:90%"></iframe>
  </body>
</html>

If you see the text “You’ve been clickjacked!” at the top of the page, your site is vulnerable.

How does that prove my website is vulnerable?

|improve this question
  • how to implement clickjacking on application? – lakshmi Prudhvi Jul 1 '13 at 10:17
4

Your webpage allows itself to be put inside an iframe.

An attacker can easily put your site in an iframe on his webpage, cleverly mask most of it, and trick the user into clicking a button there.

Because of CORS and CSRF tokens, usually websites under a different domain cannot spoof requests to your website. However, they can trick the user into clicking buttons (for example, the "logout" button.)

Read this OWASP page to learn how to protect against clickjacking

|improve this answer
4

You allow the webpage to be framed from another domain than those under your control. Read the OWASP article on clickjacking.

There are two main ways to prevent clickjacking:

  1. Sending the proper browser response headers that instruct the browser to not allow framing from other domains
  2. Employing defensive code in the UI to ensure that the current frame is the most top level window

It proves that your application is frameable by other domains and hence, click-jackable.

|improve this answer
1

Happened to come across this question and figured I'd chip in to clarify what the problem is with that test. It's not really incorrect, but it only accounts for the clickjacking defense script that is mentioned on the page. It does not take into account the X-FRAME-OPTIONS header defense.

If you perform that test there are a couple of things that could happen:

  • The clickjack text disappears: This means that there is a javascript defense, and that there either is no header defense or your browser doesn't support it.
  • The clickjack text is still there but nothing is shown in the iframe: This means that there is a header defense, and your browser supports it. You can't tell if the javascript defense is implemented because the iframe page is never loaded.
  • The clickjack text is still there, and the site loaded in the iframe: This means that there is no javascript defense, and that there either is no header defense or your browser doesn't support it.

As the second options shows, the page can be properly protected but you still see the clickjack text. To be sure, it's probably best to perform the test with both a modern and older browser without X-FRAME-OPTIONS support.

Naturally, both defenses should be implemented. The header defense is aimed towards modern browsers, while the javascript defense protects legacy browsers.

Check out https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet for more information.

|improve this answer
0

I tried http://google.com website in place of localhost you have up there and it still shows you have been clickjacked. I do not think seeing that message is the indication that your site is vulnerable. Rather if you see your webpage in iframe with that message means it is click jackable. Correct me if I am wrong.

|improve this answer
  • The vulnerability is in that the website isn't protecting against being framed, as mentioned in the other answers. – Xander Oct 8 '13 at 15:43
  • Still have this doubt as posted by DoodleKana. As per the google or gmail website goes, it says it is protected from Clickjacking. Where as when i replace local host with gmail, i can see the output as "You have been clickjacked". Please help me understand how is it possible. – Rndp13 Nov 19 '15 at 6:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.