17 Jun
2021
17 Jun
'21
4:52 a.m.
Hello,
SiR / Madam,
sparta.eu Security Support Team, My Name Is* SHIVAM KHAMBE* From India. I
Am *Security** Researcher's*
*I Am Found Clickjacking Vulnerability ,*
Your website deals with security issues.
What is Click Jacking Vulnerability ?
1.Clickjacking (User Interface redress attack, UI redress attack, UI
redressing) is a malicious technique of tricking a Web user into clicking
on something different from what the user perceives they are clicking on,
thus potentially revealing confidential information or taking control of
their computer while clicking on seemingly innocuous web pages.
2.The server didn't return an X-Frame-Options header which means that this
website could be at risk of a clickjacking attack. The X-Frame-Options HTTP
response header can be used to indicate whether or not a browser should be
allowed to render a page in a <frame> or <iframe>. Sites can use this to
avoid clickjacking attacks, by ensuring that their content is not embedded
into other sites.
Server-side methods – the most common is X-Frame-Options. Server-side
methods are recommended by security experts as an effective way to defend
against clickjacking.
This vulnerability affects Web Server.
The Vulnerable Domain Is :-
https://sparta.eu/
Step to Reproduce :-
1 :- I have given Expolit as follows.
2 :- Copy it to a Notepad copy and Past it Save as .html file
3 :- And double-click that file and open a new tab on the browser
Expolit :-
<html>
<head>
<title>Clickjack test page</title>
</head>
<body>
<p><font size="5" color="#bf0000"> Website is vulnerable
to clickjacking!
500x500</font></p>
<iframe src="https://sparta.eu/" width="500"
height="500"></iframe>
</body>
</html>
Impact:
*By using Clickjacking technique, an attacker hijack's click'smeant for one
page and route them to another page, most likelyfor another application,
domain, or both.*
*REFERENCE Suggestions :*
https://owasp.org/www-community/attacks/Clickjacking
*# Everything is shown in the POC in a quick way ...
*Best Regards,*
