Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-23 13:13:41 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/pentesting-web/clickjacking.md

14 KiB
Raw Blame History

点击劫持

☁️ HackTricks 云 ☁️ -🐦 推特 🐦 - 🎙️ Twitch 🎙️ - 🎥 YouTube 🎥


使用 Trickest 可以轻松构建和自动化由全球最先进的社区工具提供支持的工作流程。
立即获取访问权限：

{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}

什么是点击劫持

点击劫持是一种攻击，它通过欺骗用户点击一个不可见或伪装成其他元素的网页元素。这可能导致用户不知情地下载恶意软件、访问恶意网页、提供凭据或敏感信息、转账或在线购买产品。（来自这里）。

预填表单的技巧

有时可以在加载页面时使用 GET 参数来填充表单字段的值。攻击者可以利用这种行为填充表单的任意数据，并发送点击劫持有效负载，以便用户按下提交按钮。

使用拖放填充表单

如果你需要用户填写一个表单，但又不想直接要求他写入一些特定的信息（比如你知道的电子邮件或特定密码），你可以要求他拖放某个东西，这个东西将写入你控制的数据，就像这个例子中的那样。

基本有效负载

<style>
iframe {
position:relative;
width: 500px;
height: 700px;
opacity: 0.1;
z-index: 2;
}
div {
position:absolute;
top:470px;
left:60px;
z-index: 1;
}
</style>
<div>Click me</div>
<iframe src="https://vulnerable.com/email?email=asd@asd.asd"></iframe>

多步骤有效载荷

Clickjacking attacks can be made more complex by using a multistep payload. In a multistep payload, the attacker tricks the victim into performing multiple actions without their knowledge.

For example, the attacker can create a malicious webpage that contains multiple invisible buttons or links. Each button or link triggers a different action on the target website. By overlaying these buttons or links with enticing content, the attacker can trick the victim into clicking on them without realizing the consequences.

To implement a multistep payload, the attacker needs to carefully plan the sequence of actions and ensure that they are executed in the desired order. This can be achieved by using JavaScript to control the timing and execution of each step.

The multistep payload can be used to perform a wide range of malicious activities, such as:

  • Performing unauthorized actions on the target website, such as changing account settings or making purchases.
  • Extracting sensitive information from the victim, such as passwords or credit card details.
  • Exploiting vulnerabilities in the target website to gain unauthorized access or execute arbitrary code.

To protect against multistep payload attacks, website owners should implement clickjacking protection measures, such as the X-Frame-Options header or Content Security Policy (CSP). Additionally, users should be cautious when clicking on unfamiliar or suspicious links, especially if they appear to be overlaid with enticing content.

<style>
iframe {
position:relative;
width: 500px;
height: 500px;
opacity: 0.1;
z-index: 2;
}
.firstClick, .secondClick {
position:absolute;
top:330px;
left:60px;
z-index: 1;
}
.secondClick {
left:210px;
}
</style>
<div class="firstClick">Click me first</div>
<div class="secondClick">Click me next</div>
<iframe src="https://vulnerable.net/account"></iframe>

拖放 + 点击有效载荷

Clickjacking is a technique that tricks users into clicking on something different from what they perceive. This can be achieved by overlaying an invisible element on top of a legitimate button or link, making the user unknowingly interact with the hidden element instead.

Clickjacking can be combined with drag and drop functionality to create more sophisticated attacks. By using JavaScript, an attacker can capture the drag and drop events and redirect them to a hidden element, effectively hijacking the user's actions.

To implement a drag and drop + click payload, follow these steps:

  1. Identify the target element: Find the button or link that you want the user to unknowingly click on.

  2. Create a hidden element: Use CSS to position an invisible element on top of the target element. This can be done by setting the element's opacity to 0 or by positioning it outside the visible area of the page.

  3. Capture drag and drop events: Use JavaScript to capture the drag and drop events on the page. This can be done by attaching event listeners to the relevant elements.

  4. Redirect the events: When a drag and drop event is triggered, redirect it to the hidden element instead of the intended target. This can be done by modifying the event object and changing its target property.

  5. Trigger a click event: Once the drag and drop event is redirected to the hidden element, trigger a click event on that element. This will simulate a user clicking on the target element.

By combining drag and drop functionality with clickjacking, an attacker can trick users into performing actions without their knowledge or consent. This technique can be used to perform various malicious activities, such as submitting forms, making purchases, or even executing arbitrary code on the victim's machine.

<html>
<head>
<style>
#payload{
position: absolute;
top: 20px;
}
iframe{
width: 1000px;
height: 675px;
border: none;
}
.xss{
position: fixed;
background: #F00;
}
</style>
</head>
<body>
<div style="height: 26px;width: 250px;left: 41.5%;top: 340px;" class="xss">.</div>
<div style="height: 26px;width: 50px;left: 32%;top: 327px;background: #F8F;" class="xss">1. Click and press delete button</div>
<div style="height: 30px;width: 50px;left: 60%;bottom: 40px;background: #F5F;" class="xss">3.Click me</div>
<iframe sandbox="allow-modals allow-popups allow-forms allow-same-origin allow-scripts" style="opacity:0.3"src="https://target.com/panel/administration/profile/"></iframe>
<div id="payload" draggable="true" ondragstart="event.dataTransfer.setData('text/plain', 'attacker@gmail.com')"><h3>2.DRAG ME TO THE RED BOX</h3></div>
</body>
</html>

XSS + Clickjacking

如果你发现了一个需要用户点击某个元素来触发的 XSS 攻击，而且页面容易受到点击劫持的影响，你可以利用这个漏洞来欺骗用户点击按钮/链接。
例子：
你在账户的某些私人详细信息中发现了一个 自我 XSS（只有你可以设置和读取的详细信息）。用于设置这些详细信息的页面容易受到点击劫持的影响，你可以使用 GET 参数预填充表单。
__攻击者可以准备一个 点击劫持 攻击，将 XSS 载荷预填充到表单中，并欺骗用户提交表单。因此，当表单被提交并且值被修改时，用户将执行 XSS。

如何避免点击劫持

客户端防御

可以在客户端执行脚本，执行以下行为来防止点击劫持：

  • 检查并强制当前应用窗口是主窗口或顶层窗口，
  • 使所有框架可见，
  • 防止点击不可见的框架，
  • 拦截并标记用户可能遭受的点击劫持攻击。

绕过

由于框架破坏器是 JavaScript，因此浏览器的安全设置可能会阻止其运行，甚至浏览器可能根本不支持 JavaScript。攻击者对抗框架破坏器的有效方法是使用 HTML5 iframe 的 sandbox 属性。当设置了 allow-forms 或 allow-scripts 值，并且省略了 allow-top-navigation 值时，框架破坏器脚本将被中和，因为 iframe 无法检查自己是否为顶层窗口：

<iframe id="victim_website" src="https://victim-website.com" sandbox="allow-forms allow-scripts"></iframe>

allow-forms和allow-scripts值都允许在iframe内执行指定的操作，但禁用顶级导航。这样可以阻止破坏框架的行为，同时允许在目标站点内使用功能。

根据执行的Clickjacking攻击类型，您可能还需要允许allow-same-origin和allow-modals或更多。在准备攻击时，只需检查浏览器的控制台，它可能会告诉您需要允许哪些其他行为。

X-Frame-Options

X-Frame-Options HTTP响应头可用于指示浏览器是否允许在<frame>或<iframe>中呈现页面。网站可以使用此功能来避免Clickjacking攻击，确保其内容不被嵌入到其他站点中。为所有包含HTML内容的响应设置**X-Frame-Options**头。可能的值包括：

  • X-Frame-Options: deny，防止任何域嵌入内容（推荐的值）
  • X-Frame-Options: sameorigin，仅允许当前站点嵌入内容。
  • X-Frame-Options: allow-from https://trusted.com，**允许指定的'uri'**嵌入此页面。
  • 请检查下面的限制，因为如果浏览器不支持它，这将导致失败。
  • 其他浏览器支持新的CSP frame-ancestors指令。有些浏览器同时支持两者。

内容安全策略（CSP）frame-ancestors指令

推荐的Clickjacking保护是将**frame-ancestors指令**纳入应用程序的内容安全策略中。
**frame-ancestors 'none'指令的行为类似于X-Frame-Options deny**指令（没有人可以嵌入页面）。
**frame-ancestors 'self'指令与X-Frame-Options sameorigin**指令大致等效（只有当前站点可以嵌入）。
frame-ancestors trusted.com指令与X-Frame-Options allow-from指令大致等效（只有受信任的站点可以嵌入）。

以下CSP将仅允许来自同一域的框架：

Content-Security-Policy: frame-ancestors 'self';

有关更多详细信息和更复杂示例，请参阅以下文档：

限制

  • **浏览器支持：**CSP frame-ancestors尚未得到所有主要浏览器的支持。
  • **X-Frame-Options优先：**CSP规范的“与X-Frame-Options的关系”部分说：“如果资源使用包含名为frame-ancestors的指令的策略进行传递，并且其处理方式为“强制执行”，则必须忽略X-Frame-Options头部”，但Chrome 40和Firefox 35会忽略frame-ancestors指令，而是遵循X-Frame-Options头部。

参考资料


使用Trickest轻松构建和自动化工作流程，使用全球最先进的社区工具。
立即获取访问权限：

{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}

☁️ HackTricks Cloud ☁️ -🐦 Twitter 🐦 - 🎙️ Twitch 🎙️ - 🎥 Youtube 🎥