dennischen
Newbie
- Dec 10, 2013
- 21
- 10
Recently, I received a report that my website is infected by malicious. After doing research. Here is information about it.
What is Click Jacking Vulnerability?
1.Click Jacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.
2.The server didn't return an X-Frame-Options header which means that this website could be at risk of a click Jacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid click Jacking attacks, by ensuring that their content is not embedded into other sites.
Server-side methods – the most common is X-Frame-Options. Server-side methods are recommended by security experts as an effective way to defend against clickjacking.
Example of Click Jacking
Step to Reproduce:
Step 1.I have given Exploit as follows.
Code:
<html>
<head>
<title>Clickjack test page</title>
</head>
<body>
<p><font size="5" color="#bf0000"> Website is vulnerable to clickjacking! 900x900</font></p>
<iframe src="https://abcxyz.com/(Replace with your website's domain)" width="900"
height="900"></iframe>
</body>
</html>Step 2. Copy it to a Notepad copy and Past it Save as .html file
Step 3. And double-click that file and open a new tab on the browser
Impact:
By using Click jacking technique, an attacker hijack's click's
meant for one page and route them to another page, most likely
for another application, domain, or both.
Final Thoughts
I've been using TwinRed Ads Network for my website. Is it the cause? (I suspect it is caused). Please comment your ideas!
