Clickjacking - Hacking Web Application UIs

Key Takeaways

click tracking or UI redressing is a technique that tricks users into clicking on unintended elements and in this video we're going to break down how this attack works and solve a lab as always if you enjoyed the video don't forget to like And subscribe and let's dive straight in the core components of Click jacking is the use of iframes this is an HTML element that allows the embedding of an external web page within the current page even now I'm sure you can imagine how that might be dangerous to pull off this attack though we overlay the content of a legitimate website with malicious contents essentially creating a frame around what the user can see this technique is called Framing and with a little CSS to modify the transparency a user will think that they're clicking on something legitimate but actually interacting with the content of the iframe there are some famous examples of this attack both Facebook and Twitter have had their like and follow buttons click jacked and also steam had a fake login page that was laid over the top of the real login page to capture credentials but clickjacking attacks are often subtle and go unnoticed so it's likely that there are also many undocumented cases now whilst this attack might not be something that you see very often it's important as whether pen testers or security Engineers to understand the context in which this attack can appear if you want to understand how to defend against this attack it's worth checking out the x-frame options and CSP headers now let's take a look at the lab so here we are at the portsmoker Academy and it says that this lab contains login functionality and a delete accounts button that is protected by a cross-site request forgery token a user will click on elements that display the word click on a decoy website to solve the lab craft some HTML that frames the account page and fools the user into deleting their accounts the lab is solved when the account is deleted and we have some credentials of our own as well so let's dive in so here we have our lab and all we're going to do is click my accounts and log in with Vena and Peter and we can see we have the account page and this delete Account button is what we're targeting so if we head to the exploit Setter the first thing we want to set up is we need an iframe so we're just going to go iframe Source equals and we'll use the link from the my accounts page and if we click view exploit you'll see that we do indeed get this iframe so let's come back and style this a little bit so we're just going to come to the top open up some CSS and then we're going to do iframe like this so in here we want a position so I'm just going to use position relative and then give it a width of a thousand pixels because it was a little small and a height of a thousand pixels as well and then I want to set the opacity to 0.1 and then I'm going to set the Z index to 2 as well and this is because we're going to set the Z index of the div or the item that we want our user to focus and click on to the Z index of one so we can click view exploits again and we can see just about that we have our page and it actually is asking us to log in so I'm just gonna log in with our credentials again so that we can see the account page obviously when the user loads this they'll already have their session token so they'll hit the account page rather than login page but in our case we just needed to log in so I'm just going to come back and if I change the opacity to let's say 0.5 you can probably see this a little bit more clearly so let's leave it at that now here we want to Overlay The Click me div over the account button so let's start by adding the div click me click view again and you can see it appears at the top so we need to style this and this time what we're going to do is we're going to position it absolute so position absolute and then we're going to say top 100 pixels and then left let's say 50 pixels and see where it is on the page and you can see it lands a little bit here so we need it to be much further down so I'm just going to come back change this to 500 click View and it's very very close so I'm just going to give it an extra 20 pixels and I think that's about close enough so if you notice when we hover over click me the icon changes so that if you click on this it's actually going to click the delete accounts button but obviously we don't want to delete our own account so I'm not going to go ahead and click it just yet so next up all we do is we click store and then we click deliver exploit to victim and we get a congratulations you solved the lab so that was fairly straightforward but in reality we may have to work a little bit harder to entice our users so there's actually a tool that we can use that is built into web Suite where we can test and quickly create payloads so all I'm going to do is come over to burp Suites and click burp and click click Bandit and here we have a tool for generating click jacking attacks so the steps to do this are to copy the click Bandit to clipboard we paste it into the page in our browser and then we follow the on-screen instructions so here I'm just going to copy click Bandit to clipboard come back to our page and I'm going to come to the my account page hit Ctrl shift C come over to console and just paste here and click enter now I'm going to close the console and you can see that we have a new Banner at the top so I'm just going to click disable click actions because I want to be able to click the delete Account button without actually deleting our accounts and then I'm going to click Start and here I just come through and I click home my accounts log out update email and delete accounts and then just click finish and what it's going to do it's going to go through and test this so we can click click click click click and we see that we have pin click jacked and here if we want to save the payload to review and tweak probably a little bit and carry out the attack we can just click save and we can save the HTML document to our file system so in our lab our user was a little bit of a dummy they're going to click on anything that has the keyword click in it in reality of course we might need to try a little bit harder to entice our users but this was still a good demo of how to pull off this attack there are plenty more Labs available such as click tracking with pre-filled input forms bypassing frame busting scripts and combining click jacking and cross-site scripting so check those out if you want to learn more there's also a great post over on the author blog that I'd recommend checking out and of course clickjacking is covered by the owasp cheat sheet series a resource that we've mentioned once or twice in our more recent videos all in all if you're interested in attacking users it's definitely a technique that's worth investigating further and that's it for this video as always don't forget to like And subscribe and if you have an idea for a topic you'd like to see in the future then leave it in the comments below catch you next time