Collaborate Disseminate
I have a doubt regarding the use of the Content Security Policy (CSP) as protection mechanism against clickjacking.
I have created an online Proof of Concept (PoC) on a web page where I put a button that loads the URL that is… Continue reading Content Security Policy against Clickjacking fails when static PoC
A vulnerability in Cisco’s meeting server software allows a remote attacker to masquerade as legit user. Continue reading Cisco Patches Critical Bug In Video Conferencing Server Hardware
Do you know that you can access your WeChat, Line and WhatsApp chats on your desktop as well using an entirely different, but fastest authentication system?
It’s SQRL, or Secure Quick Response Login, a QR-code-based authentication system that allows u… Continue reading QRLJacking — Hacking Technique to Hijack QR Code Based Quick Login System
Security researchers at Skycure are upping the ante on a vulnerability that it says now leaves 95.4 percent of all Android devices vulnerable to an attack that hands over control of a phone or tablet to an attacker. Continue reading Scope of Gaping Android Security Hole Grows
A group of cyber criminals has infected as much as 1 Million computers around the world over the past two years with a piece of malware that hijacks search results pages using a local proxy.
Security researchers from Romania-based security firm Bitdef… Continue reading 1 Million Computers Hacked for making big Money from Adsense
X-Frame-Options header will prevent your site from being iFramed by other domains. On browsers that accept the ALLOW-FROM directive you are limited to specifying only a single origin. You could use a CSP 2.0 frame-ancestors directive for m… Continue reading Is this a secure method for dynamically setting X-Frame-Options? (multiple domains)
How can a hacker deliver a clickjacking attack?
Does the hacker need to manipulate a “good.com” website and change its original code?
Does the hacker create an “evil.com” website and just put a transparent layer with malici… Continue reading How to "deliver" a clickjacking attack?
Clickjacking vulnerabilities are endemic throughout the web and really quite serious in the right circumstances. Manually crafting a proof of concept attack can mean laborious hours of offset-tweaking, so we’ve just released Burp Clickbandit, a point… Continue reading Burp Clickbandit: A JavaScript based clickjacking PoC generator
Clickjacking vulnerabilities are endemic throughout the web and really quite serious in the right circumstances. Manually crafting a proof of concept attack can mean laborious hours of offset-tweaking, so we’ve just released Burp Clickbandit, a point… Continue reading Burp Clickbandit: A JavaScript based clickjacking PoC generator
As I understand it, this is how an attacker would exploit clickjacking:
Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over the HTML elements of my site.
Send out … Continue reading Is Clickjacking a real security vulnerability?