Skip to main content

X-Frame-Options a countermeasure for Click-Jacking.

Introduction:

What is Click-Jacking?


Click-jacking, also known as a "UI redress attack", It is a malicious technique of tricking a web user into clicking on something different from what the user perceives they are clicking on.

 What is an Impact?

An attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to other another page, most likely owned by another application, domain, or both.Using a similar technique, keystrokes can also be hijacked. With a carefully crafted combination of style sheets, I-frames, and text boxes, a user can be led to believe they are typing in the password to their email or bank account, but are instead typing into an invisible frame controlled by the attacker.

How can we Mitigate?


We can mitigate the Click-Jacking with the help of X-Frame-Options in HTTP response header.


The X-Frame-Options header can be used to control whether a page can be placed in an IFRAME. Because the Frame sniffing technique relies on being able to place the victim site in an IFRAME, a web application can protect itself by sending an appropriate X-Frame-Options header.
 

What is X-Frame-Options?

X-Frame-Options is a mitigation technique for click jacking attacks. It is an HTTP response header sent by the server to indicate under what circumstances page contents should be displayed in a frame context. A browser that understands the header will not display the contents of a page if the header directive is violated (for instance, if evil-example.com puts good-site.com in an I-frame but good-site.com sends a header that says X-Frame-Options: DENY. Thus, no click jacking can occur because no UI elements can be displayed to a victim.

What are the types of X-Frame-Options Header?

There are three possible values for the X-Frame-Options headers:
•           DENY, which prevents any domain from framing the content.

•           SAMEORIGIN, which only allows the current site to frame the content.

•           ALLOW-FROM Uri, which permits the specified 'Uri' to frame this page. As explained below. The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet. BE CAREFUL ABOUT DEPENDING ON ALLOW-FROM. If you apply it and the browser does not support it, then you will have NO click jacking defense in place.

 Configuring the X-Frame-Options in IIS

To configure IIS to add an X-Frame-Options header to all responses for a given site, follow these steps:
  1. Open Internet Information Services (IIS) Manager.
  2. In the Connections pane on the left side, expand the Sites folder and select the site that you want to protect.
  3. Double-click the HTTP Response Headers icon in the feature list in the middle.
  4. In the Actions pane on the right side, click Add.
  5. In the dialog box that appears, type X-Frame-Options in the Name field and type SAMEORIGIN in the Value field.
  6. Click OK to save your changes.

 
 



Comments

Post a Comment

Popular posts from this blog

Android Damn Vulnerable App by Security Compass

Tutorial of Android Damn Vulnerable App by Security Compass Introduction: Hi folks, today I am gonna show you some hands on or tutorial of the android app testing which I done during my R&D of android app security testing. Here I will show you from scratch setting up of Lab Server to testing of application. In this you will learn on below topics: 1)Insecure Connection (Traffic over HTTP) 2)Server Side Authorization Issue 3)Insecure File Storage 4)Insecure Logging 5)Encryption of data on device 6)Memory Protection Setting-up of lab (App & Server) First of all you have to download the base app which is damn vulnerable from here . After downloading zip and extracting it you have to build it in .apk format using Eclipse IDE. Now you have to install the app in the emulator before that you have to make sure that you installed SDK and its packages. To install the app you have to start emulator using AVD and clicking on "Start" or by command line emul...
24 comments
Read more

Damn Vulnerable Android Application by Security Compass - Lab 6 Advanced Encryption

Lab 6 Advanced Encryption  Today we are going to see the solution of basic encryption post in that no encryption was used for sensitive info. The solution is implementing the encryption and that we will try to bypass the encryption implementation as some times the developers store the hardcoded encryption key in the app itself. For this you need to install the BasicEncryptionSolution.apk. Now start this app and configure the credentials.   Now app is configured and credentials are also stored as per design in preferences.xml but I am expecting some sort of encryption now as we have installed solution for this flaw. Browse to the /data/data/com.securitycompass.androidlabs.basicencryptionsolution/shared_prefs as you can see that all the credentials are encrypted. So now we go and disassemble the app and try to figure out is there any key hardcoded key in the app. You can disassemble the app by using EasyApkDisassembler to...
9 comments
Read more

Damn Vulnerable Android Application by Security Compass - Lab 2 Server Side Authorization Issue

 Lab 2 Server Side Authorization Issue Welcome back my friends now we are gonna have hands on on server side authorization issue in this lab we will use burp proxy try to manipulate the parameters and will see the impact. The server side authorization issue is in bank transfer function of an app as now a days some android apps rely on traditional architecture like REST interfaces to perform the functions. We can intercept the server client communication in 2 ways: 1) Go to settings -->more -->mobile networks --> Access point names create one new access point change proxy option to your proxy IP and change the port to port of proxy and save it. now your communication will be intercepted by proxy. 2)Another way is to start the emulator in proxy mode by giving below command emulator.exe @[AVD name] -http-proxy [proxy IP]:[proxy port] so now we are ready to intercept the communication. Lets launch the app Now as I said the server s...
9 comments
Read more