This articles is written by me to show that Clickjaking should not be underestimated as a vulnerability, especially when combined with other vulnerabilities. Clickjaking (User Interface redress attack) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages. That is good in theory , but how can someone do that in practice? The answer is simple , ridiculously easy...
Even a script kiddy can become a "hacker" con-artist when combining vulnerabilities. In this post I am going to show how a simple CSRF attack can actually be combined with a clickjaking attack, of course the same think can happen with vulnerabilities such as session fixation and XSS.
The Clickalicious Attack
In order to perform the attack we would have to be based in the following assumptions:
- We identified a website that is vulnerable to Clickjaking (e.g. is missing the X-Frame-Options) .
- The same Web Site is also vulnerable to CSRF (e.g. the CSRF is a simple html form).
- The CSRF attack exploits a vulnerability that a malicious user can actually submit the form with polluted hidden form fields (for simplicity I am going to use a simple html form for the demo).
<iframe src="http://www.w3schools.com"></iframe>
The visual outcome of this code wold be:
Note: The picture above displays only the iframe and not the whole page. In this particular example the html page was loaded from my hard disk.
Step 2: Project the CSRF to the vulnerable web site within the iframe created in Step 1. The simple source code to do that would be:
<html> <body> <head> <style>form { position:absolute; left:30px; top:100px; }</style> </head> <form> First name: <input type="text" name="firstname"><br> Last name: <input type="text" name="lastname"> </form> <iframe src="http://www.w3schools.com"></iframe> </body> </html>
See the CSS absolute element? The CSS 2.1 defines three positioning schemes:
- Normal flow
- Absolute positioning
- Position: top, bottom, left, and right
Note: The same exploit can be build using a stored XSS. The only difference would be that you would have to project the vulnerable CSRF within the space controlled by the XSS (without taking advantage of a Clickjaking vulnerability).
Tools such as NoScript would be able to detect the Clickjaking attack:
Note: See the icon stating that the script was blocked.
Epiloge
Next time you run a penetration test , think again before you characterize a Clickjaking as low!! especially if it is a login page. And be aware of the Script Kiddies.
The moto of this article is going to be think before you click...
References:
