Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [clickjacking]

Clickjacking is an attack where the attacker overlays their own UI over a web page, "hijacking" the clicks that the victim makes on the page.

1
vote
1answer
43 views

Tracking script creates vulnerability

I am using a third party service that provided a tracking script which when embedded in the page seems to create some kind of vulnerability as occasionally people are redirected to a phising link ...
3
votes
2answers
111 views

Under what circumstances is my website vulnerable to clickjacking?

Most of the examples I have read start with a malicious website. Lets say I am creating a website without malicious intent. When does the website become vulnerable to clickjacking? Can this occur ...
1
vote
1answer
51 views

Stealing page source via Clickjacking [closed]

I am learning Javascript. Also researching web based vulnerabilitys to learn. I just wondering how Javascript can be used to steal view page source or any text or any tokens leaking on the page via ...
0
votes
0answers
28 views

JS window.confirm cross domain security?

I have wrote an assignment for a course I am studying regarding social plugins like what you get with Facebook/Twitter, etc. With these platforms the user is directed to a seperate tab/window to ...
0
votes
0answers
49 views

Clickjacking when essential JavaScript code accesses attribute of 'top'?

Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg: // http://...
2
votes
2answers
133 views

Clickjacking vulnerability of file attachment downloads?

A portion of our system exposes an HTTP file handler that transmits a file to the client provided that authentication and file ID are correct, and no response if not. The ASP.net server this is ...
1
vote
1answer
773 views

X-Frame-Options header on redirect

I have several web applications running on my server (Debian 8 running Apache). One of my customers wants to improve the security of his app, after having some security audits carried out by a third-...
1
vote
1answer
331 views

Loading a logged in page in an iframe

Suppose www.youtube.com have no X-Frame-Options set. Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send ...
2
votes
1answer
518 views

How to steal source code through clickjacking?

Is it possible to steal the source code through clickjacking, so that attacker can also steal the CSRF tokens? This is a demo attack website: <!DOCTYPE html> <html> </div> <div ...
4
votes
1answer
104 views

iframe Checkout Procedure

I'm working for a company that wants to allow anyone to embed an iframe in which users can buy products on potentially any site. So it would be a typical use case for users to enter in their credit ...
5
votes
1answer
887 views

Content-Security-Policy: Getting weird reports with frame-ancestors 'self'

Right now, I maintain the Content-Security-Policy for https://www.lidl.de, which is: Content-Security-Policy: frame-ancestors 'self'; block-all-mixed-content; report-uri https://lidlcsp.report-uri.io/...
5
votes
3answers
49k views

How to add X-Frame-Options header to a simple HTML file?

I am having trouble adding X-Frame-Options header to a simple HTML file. Is there any way to do it using JavaScript?
-2
votes
2answers
652 views

.Net Core MVC Clickjacking attack [closed]

How can we prevent a clickjacking attack using iframes etc. in .Net MVC core application?
0
votes
1answer
260 views

Is it possible to still perform click-jacking with if a website has SSL? [closed]

There are someways to stop click-jacking on websites without HTTPS, but I have seen that you cannot perform click-jacking on website the does have SSL. Is this true or can you still perform click-...
1
vote
2answers
569 views

How can someone stop clickjacking?

I was looking at a lecture of clickjacking and when I tried to create an iframe to go to website, I noticed that websites with no https are able vulnerable to clickjacking. Is there another way to ...
0
votes
3answers
5k views

How to avoid clickjacking in HTML and Javascript

I tried to put the following code in HTML but it is not helping me avoid me the clickjacking: meta http-equiv="X-Frame-Options" content="DENY" I wrote the following code in Javascipt: if (self == ...
2
votes
1answer
902 views

Bypassing x-frame options possibility discussion

This has something to do with a different post I made: Other post While researching this a bit further I found the following blogpost: blog elev As I understand it this guy reads all content of a ...
3
votes
3answers
8k views

Bypass x-frame-options for clickjacking

Is there any way to bypass the x-frame-options header without using a MitM or changing the packets in another way? So actually getting a site that has x-frame-options: DENY to be shown in an iframe.
0
votes
1answer
1k views

x-frame-options header doesn't prevent showing site in iframe

For my site I see that among response headers there is X-Frame-Options: SAMEORIGIN. Still I can preview my site in iframe of some different site, for instance here. But I expected not to. I assume ...
2
votes
3answers
550 views

Content Security Policy against clickjacking fails with static PoC

I have a doubt regarding the use of the Content Security Policy (CSP) as protection mechanism against clickjacking. I have created an online Proof of Concept (PoC) on a web page where I put a button ...
2
votes
2answers
462 views

How to protect against clickjacking via pop-under windows?

Huang and Jackson described a method of clickjacking that does not rely on iframes, but on pop-under windows. Is this attack still relevant today, or is it prevented by pop-up blockers? Is there any ...
2
votes
1answer
1k views

To protect against clickjacking, is it safe to have a web page display its content until framing is detected?

Let's assume we have a web page that can't use X-Frame-Options, and the Clickjacking protection has to be JavaScript based. On this page, all sensitive actions and the display of sensitive information ...
4
votes
1answer
969 views

Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)

X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a ...
4
votes
1answer
757 views

How to “deliver” a clickjacking attack?

How can a hacker deliver a clickjacking attack? Does the hacker need to manipulate a "good.com" website and change its original code? Does the hacker create an "evil.com" website and just put a ...
2
votes
1answer
1k views

Is the Framekiller really safe against clickjacking?

I am using this code. In the header section of the page, this CSS rule: html{display:none;} And then this javascript: if (self == top) document.documentElement.style.display = 'block'; else top....
3
votes
2answers
190 views

How protect mobile website against encapsulating into rogue native mobile app?

We are developping a mobile application (m.website.com). Is there a way to prevent a rogue developper to build an IOS / Android native app that simply encapsulate our website into the app using ...
0
votes
1answer
373 views

Setting certain response headers only if Referer is invalid

I came across this technique and I'm curious if there are any flaws in this design. A site sets the X-Frame-Options response header to deny only if the Referer header is not define or does not match ...
1
vote
1answer
306 views

If the site is not loaded in the frame, is the site vulnerable to click jacking.

Came across this question in SE How does this test prove my application is vulnerable to clickjacking attacks? I have a follow-up question and doubt, please help me to clear it. As per https://www....
1
vote
2answers
461 views

should one use “framekiller” code avoid others embedding https pages in iframes?

I found various discussions about https being embedded in iframes for various reasons. I tested it and saw that one bank site escapes the iframe and the other allows being embedded in an iframe. ...
1
vote
2answers
1k views

How to set X-FRAME-OPTIONS where 3rd Party frame is required to be loaded?

We have set the set X-Frame-Options in the header as ALLOW-FROM same origin but there is a requirement to open below page from some 3rd party website. Do you see security issue here? HTTP::header ...
7
votes
1answer
797 views

Protection against clickjacking in Firefox without installing addons?

On some of my workstations I never allow Javascript in Firefox. The NoScript addon is installed on these machines, but I would like to remove it and disable Javascript via about:config instead. ...
5
votes
2answers
667 views

How to trace source of clickjacking attack within a website using developer tools?

When surfing a popular Wordpress website on my mobile, clicking on a link to an article within would sometimes open a new window to a malicious website or launch the Apps Store. I am interested to ...
3
votes
2answers
2k views

Is it neccessary to use X-FRAME-OPTIONS to prevent ClickJacking attacks?

I use this Javascript Code, and it works perfectly: if (top.location != location) top.location.href = location.href Many researchers told me to not use this. Can any one bypass it? Are there any ...
1
vote
4answers
2k views

how can this prove a clickjacking vulnerability?

How does just putting a site link in an iframe (and when opens in iframe) indicate that the site is vulnerable to a click jacking attack? I have also read that if the site is a forum base, then the ...
31
votes
1answer
9k views

Is Clickjacking a real security vulnerability?

As I understand it, this is how an attacker would exploit clickjacking: Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over ...
1
vote
3answers
600 views

Clickjacking on a site without user accounts

My understanding of clickjacking attacks is that an attacker could embed my site in his. The attacker then uses clever styling to trick the user into performing actions on my site, that they did not ...
3
votes
1answer
2k views

Protect against clickjacking but allow framing on domain?

I'd like to protect against clickjacking using the X-Frame-Options header, but we occasionally frame secure content on the insecure version of our site1: Since it looks like only Firefox currently ...
1
vote
1answer
242 views

When is it appropriate to provide clickjacking protection one of my websites pages?

I run a couple of websites, so I'm just wondering what is the appropriate use of clickjacking protection like the x-frame-options response header? What pages are susceptible to this kind of attack on ...
0
votes
1answer
252 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
2
votes
4answers
6k views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
13
votes
4answers
3k views

How do I protect myself from clickjacking attacks?

I've seen many friends getting clickjacked on Facebook and similar sites. How does one detect and prevent clickjacking? How should I teach my friends to do the same?
2
votes
1answer
7k views

How to prevent the following clickjacking attack?

The Security attribute was implemented to prevent XSS attacks in iFrames by disabling any JS implemented in the iFrame source, therefore indeed eliminating XSS attacks, but also disabling any security ...
12
votes
2answers
3k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...