ClickJacking Analysis for Web Security)

ClickJacking Analysis for Web Security)

ClickJacking is a visual deception. There are two methods. One is that an attacker uses a transparent iframe to overwrite a webpage and then induces the user to perform operations on the webpage, at this time, the user will click the transparent iframe page without knowing it; the second is that the attacker uses an image to overwrite the page and obscure the meaning of the original position of the page;

Iframe Overwrite

Examples

1. If we have a post on Baidu, we want to secretly let others pay attention to it. So we prepare a page:

  
PS: The page looks like this. Of course, the truly attacked page will be more refined, not as simple as that.
2. After the website is spread out, the user clicks "View Details" and clicks "follow.
PS: You can set the iframe transparency to 0.3 to view the actual point.
3. There will be another fan.
Solution
Use an HTTP header -- X-Frame-Options. X-Frame-Options is generated to solve ClickJacking. It has three optional values:
DENY: the browser rejects the current page from loading any frame page;
SAMEORIGIN: The frame page address can only be a page under the same-source domain name;
ALLOW-FROM origin: the address of the page that allows frame loading;
PS: browser support: IE8 +, Opera10 +, Safari4 +, Chrome4.1.249.1042 +, and Firefox3.6.9.
Specific settings:
Apache configuration:
Header always append X-Frame-Options SAMEORIGIN
Nginx Configuration:
add_header X-Frame-Options SAMEORIGIN;
IIS configuration:
  
        ...     
           
    
                 "
    
   
  X-Frame-Options" value="SAMEORIGIN" />                 ... 
 
 
Image coverage
Cross-Site Image Overlaying (Cross-Site Image Overlaying) allows attackers to overwrite images on a webpage using the style or CSS of images. Of course, the information contained in the image may have the meaning of deception, so that the user can achieve the goal of deception without clicking.
PS: This attack can easily appear on the website's own page.
Example
Add an image where HTML content can be input, but overwrite the image at the specified position.
<a href="http://tieba.baidu.com/f?kw=%C3%C0%C5%AE">     a>
Solution
When defending against image overwrite attacks, you need to check whether the style attribute of the img tag may pop up in the HTML code submitted by the user.
Summary
Clickjacking is an attack that many people do not pay much attention to. It needs to trick users into interacting with the page, and the attack cost is higher. In addition, developers may think that users are stupid and do not pay attention to such attacks.