CSP: frame-ancestors

[Big P]

Hello, is it possible to spoof them or disable them in your browser completely?

Actually i don't know very well what those are, but because of those, website doesnt load SSL certificate resourses and website detects me because of that... How can i fix this?

Anyone?

 

[davids355]

Can you give a little more detail on the circumstances; what are you trying to do, what software are you using? Maybe then someone will be able to help.

 

[Big P]

I am using Oracle VM, tried chrome and firefox, nwest, and older versions, i get that in dev console when pressing a button on the website that has some loading functions and connecting to other website. I get an error on the website itself, that error occured. I thought it had to do something with SSL/TLS so i turned off those in settings and now i got Cross-origin read blocking (CORB), some kind of deprecation error also and same frame ancestor

 

[BlogPro]

CORB errors block Cross origin errors in TLS/SSL pages.

Will need specifics on what you're trying to do before helping you.

 

[jazzc]

You can disable it. Start Chrome with these options in the command line:

--disable-web-security --user-data-dir

 

[Big P]

You can disable it. Start Chrome with these options in the command line:

--disable-web-security --user-data-dir

Did it. Still.

refused to displai pp in a frame because an ancestor violates url the following content security policy directive frame ancestors self

another one - ssl certificate used to load resources from url will be distrusted in mxx once distrusted users will be prevented from loading..

 

[Big P]

CORB errors block Cross origin errors in TLS/SSL pages.

Will need specifics on what you're trying to do before helping you.

I am trying to spoof myself from a website. I am trying to make myself to look as a completely different, but real internet user.

 

[BlogPro]

The error you've described is pretty straight forward. The headers are being sent from the server hosting the iframe and your browser cannot do anything.

The iframe is coming from the domainA.com - which has specifically requested that the frame be loaded on a page on domainA.com only and nowhere else.

The second is a certificate error, which states that the certificate will be distrusted in future releases after Google decided to distrust Symantec - Read this - https://security.googleblog.com/2018/03/distrust-of-symantec-pki-immediate.html

//

I understand you're trying to spoof yourself, but you'll have to tell us the methodology you're using in doing so, for us to be of any help.

 

[Big P]

The error you've described is pretty straight forward. The headers are being sent from the server hosting the iframe and your browser cannot do anything.

The iframe is coming from the domainA.com - which has specifically requested that the frame be loaded on a page on domainA.com only and nowhere else.


//

I understand you're trying to spoof yourself, but you'll have to tell us the methodology you're using in doing so, for us to be of any help.

I am trying to bypass pp security measures. What can i do about iframe? Can i spoof the headers so it wouldnt recognize me(cuz i think i spoof everything i can)?, how can i bypass that error?

 

[Big P]

Anyone else has knowledge on how to successfully fully spoof your browser? How to bypass frame and shie like that?

 

[Big P]

What about open ports? Is it possible that some open ports may cause this? And if yes, then how do i find out which ones?