Folders and files Name Name Last commit message
Last commit date
parent directory
View all files
Clickjacking with Burp Suite Clickjacking With Burp Suite
Learn Clickjacking through an interactive example
Leverage Burp Suite to create a Clickjacking PoC
Learn to defend against Clickjacking attacks
X-Frame-Options and Content-Security-Policy
Witness how helmet Express.js middleware can stop Clickjacking attacks
Many sensitive actions (or state changes) require clicks
Clickjacking jacks clicks from one part of the application, and applies them
to a sensitive/unintended action
Occurs because a malicious website makes UI alterations
Clickjacking Ex: Evil.com
iframe
Loads in Flash Settings page (or other sensitive page)
Login Here button
Something the user is likely to click
CSS alterations
Clickjacking Ex: Evil.com (CONT.)
Content-Security-Policy
X-Frame-Options
Mitigations: Content Security Policy (CSP)
HTTP Response Header
Controls the browser’s security settings for a given website
frame-ancestors directive
Controls if a webpage can be used within a frame or iframe
Evil.com Ex:
<iframe src="https://victim.example.com"></iframe>
Mitigations: CSP Examples
Content-Security-Policy: frame-ancestors 'none';
Prevents any domain from framing the content
' are required
Content-Security-Policy: frame-ancestors 'self';
Only allows the current site to frame the content
Everything within the current origin
Mitigations: CSP Examples (CONT.) Mitigations: CSP Compatability
Mitigations: CSP vs X-Frame-Options
CSP is meant to replace X-Frame-Options header
Many current defenses still leverage X-Frame-Options header
Ex: helmet library for Express.js (Node.js)
Mitigations: X-Frame-Options
X-Frame-Options: DENYX-Frame-Options: SAMEORIGINX-Frame-Options: ALLOW-FROM https://example.com/
Mitigations: X-Frame-Options (Compatability)
Use Burp Suite to clickjack FAmazon Juice
Prerequisites
Burp Suite
FAmazon Juice
Intentionally vulnerable web app
git clone https://github.com/SecuringTheStack/tutorials
cd $TUTORIAL_REPO /ep12-clickjacking
docker-compose up
Misc Clickjacking Examples
You can’t perform that action at this time.