Transcript
CLICKJACKINGSecurity Nightmare
Jeremiah Grossman (Whitehat Security)
Robert Hansen(SecTheory)
2008
also known as a "UI redress attack"
…is a malicious technique of tricking a web user…
…into clicking on something different… from what the user perceives they are clicking on
12 cases
+ Browser+ Plug-in+ Website
NOT ALL
<iframe>opacity & z-index
My page (malicious page)w3schools.com
<iframe src=http://www.w3schools.com></iframe>
opacity: 1;z-index: 0;
opacity: 0.5;z-index: 1;
Server side
• X-Frame-Options
• Framebuster
Client side
• No-Script
Header append X-Frame-Options “DENY”
Framebuster
No-Scripts add-on
top related