Walks

网络安全爱好者

ClickJacking简介和防御

前言:

最近看到一篇关于Clickjacking的某些浏览器不支持特性而产生的漏洞,故查查资料,记录下这些。

重点在于Clickjacking的三种防御手段、

 

目录:

0x01:什么是点击劫持(ClickJacking)

0x02:如何防御

 

什么是点击劫持(Clickjacking)

    一种视觉欺骗手段,通过frame框架包含目标网站。诱使受害者点击页面,造成一些敏感操作,例如转账,泄露个人信息等,而这时,受害者并不知道自己进行了这些操作。《ClickJacking简介和防御》

    例如上图,具体代码为

<iframe src="http://www.bywalks.com" sandbox="allow-forms"></iframe>

    我们可以修改下透明度,并在iframe框架之上加一些图片或者一些按钮操作,来诱使用户进行一些操作。

          

    

    如何防御

  •  JS代码

if(top.location!=self.locaton) {
  parent.location = self.location;
}

    这种防御手段并不严谨,可以用double iframe绕过。

 

  • X-Frame-Options

    该HTTP头配置有三种选项,分别为Deny,SameOrigin,Allow_From. 

    分别解释一下,Deny拒绝该页面被所有其他页面所包含,SameOrigin为可被同源网页所包含,Allow_From为可被白名单设置网站所包含。 

    其中Allow_From并不被所有浏览器都支持。浏览器支持如下。

《ClickJacking简介和防御》 

  • CSP安全策略

    CSP安全策略是一种基于减少攻击行为的一种方法。通过具体配置来减少漏洞的发生。

    在Clickjacking的防御中,CSP的frame-ancestors也起到了作用,但跟ALLOW_FROM一样,并不是所有的浏览器都支持这个特性。

    

    个人总结

    JS与CSP的防御都是有所限制,所以最好的方法就是设置HTTP头的X-Frame-Options为Deny或者SameOrigin。

点赞
  1. Thank you a lot for giving everyone a very special opportunity to discover important secrets from this web site. It can be so cool plus jam-packed with a lot of fun for me and my office acquaintances to visit your web site minimum three times every week to learn the newest stuff you have got. Of course, we're certainly happy considering the outstanding pointers served by you. Certain 3 points in this article are in reality the most impressive I've ever had.

  2. louboutin shoes说道:

    I'm commenting to let you be aware of what a superb experience my friend's girl developed reading through yuor web blog. She learned lots of issues, which include what it is like to possess a marvelous helping character to get most people clearly know selected complex topics. You truly surpassed our expected results. I appreciate you for delivering those valuable, trusted, edifying not to mention cool tips on the topic to Janet.

  3. Thank you so much for providing individuals with an exceptionally pleasant possiblity to read in detail from this website. It is always so useful and as well , jam-packed with a good time for me and my office colleagues to visit your website not less than thrice in 7 days to study the latest items you have. And definitely, I am certainly pleased considering the terrific tactics you give. Some 1 ideas on this page are indeed the finest we've ever had.

  4. jordan 6说道:

    I happen to be writing to let you know what a beneficial encounter my cousin's child developed browsing your web page. She figured out so many pieces, which included what it's like to have an excellent teaching mood to get men and women with no trouble thoroughly grasp several hard to do subject matter. You really did more than people's desires. Thanks for supplying those helpful, safe, revealing not to mention fun guidance on this topic to Julie.

  5. yeezy boost 350说道:

    My husband and i have been thrilled when Albert managed to finish off his research via the precious recommendations he had from your very own site. It is now and again perplexing just to happen to be giving for free facts which usually men and women might have been selling. And now we fully grasp we've got the blog owner to give thanks to for this. The entire explanations you have made, the simple site menu, the friendships you help to promote - it is mostly extraordinary, and it's really aiding our son and us reason why that issue is fun, which is very mandatory. Many thanks for the whole thing!

  6. I wish to express my thanks to you just for bailing me out of this problem. After looking out throughout the internet and seeing opinions which are not beneficial, I was thinking my entire life was over. Being alive minus the answers to the issues you have resolved all through your main short post is a serious case, and the ones which may have badly affected my career if I hadn't discovered the blog. That mastery and kindness in touching all the pieces was precious. I am not sure what I would've done if I had not encountered such a solution like this. It's possible to at this time relish my future. Thank you very much for this expert and effective guide. I won't think twice to recommend the blog to any person who requires tips on this subject.

  7. yeezy说道:

    I have to convey my admiration for your kindness supporting men and women that should have help with this important subject matter. Your very own commitment to getting the solution all around appeared to be certainly helpful and have consistently permitted associates much like me to arrive at their objectives. Your entire invaluable recommendations means much to me and a whole lot more to my peers. With thanks; from everyone of us.

  8. curry 4说道:

    Needed to draft you one bit of remark to be able to thank you so much once again for your extraordinary knowledge you have provided on this website. This is certainly remarkably open-handed of people like you to offer extensively exactly what many people would have advertised for an e-book in making some money for their own end, most notably considering that you might have tried it in the event you decided. Those tactics also acted to become good way to understand that other people have a similar eagerness really like my very own to see more and more around this matter. I'm sure there are numerous more pleasant instances up front for people who look over your website.

  9. yeezy boost说道:

    I simply had to thank you so much yet again. I am not sure what I could possibly have followed without the type of opinions documented by you relating to this situation. It has been a real frightening difficulty in my opinion, nevertheless understanding a new well-written mode you processed that made me to cry for fulfillment. Now i am happier for your service as well as have high hopes you are aware of an amazing job that you are providing instructing other individuals via a blog. Most likely you haven't come across all of us.

  10. ferragamo sale说道:

    I together with my pals ended up analyzing the excellent things found on the blog while the sudden developed an awful suspicion I never expressed respect to the web site owner for those strategies. Most of the ladies came so happy to learn them and have unquestionably been using those things. Appreciate your genuinely very considerate and also for making a decision on certain amazing subjects most people are really wanting to discover. My very own sincere regret for not expressing gratitude to earlier.

  11. lacoste polo说道:

    I not to mention my friends came checking out the good secrets and techniques from your web page then then developed a terrible feeling I never thanked the website owner for those strategies. These ladies had been certainly passionate to see all of them and have now simply been having fun with them. Thank you for indeed being quite considerate and also for getting some decent issues most people are really wanting to be informed on. Our sincere apologies for not saying thanks to earlier.

  12. air jordan 12说道:

    I must show my appreciation to you for rescuing me from such a matter. After searching through the world wide web and seeing methods which were not powerful, I believed my life was gone. Being alive without the presence of solutions to the problems you've fixed by means of your main article is a serious case, and the kind that might have negatively affected my entire career if I hadn't encountered your site. Your personal training and kindness in handling every item was useful. I'm not sure what I would have done if I hadn't come upon such a subject like this. I am able to at this moment relish my future. Thanks very much for this skilled and results-oriented guide. I will not be reluctant to suggest the blog to anybody who needs and wants care about this topic.

  13. nike react说道:

    I simply wished to say thanks yet again. I'm not certain the things I might have used in the absence of the entire smart ideas contributed by you regarding my concern. Completely was a real depressing matter in my opinion, however , viewing your specialised manner you treated the issue took me to cry for delight. I will be happy for this information and have high hopes you know what a great job you have been getting into teaching other individuals via your site. Most probably you've never got to know any of us.

  14. birkin bag说道:

    I together with my pals were actually checking out the good solutions on your web site and before long came up with a horrible suspicion I never expressed respect to the website owner for those strategies. These women had been so glad to see all of them and have now surely been taking pleasure in them. We appreciate you genuinely quite thoughtful and for finding this kind of amazing useful guides most people are really desirous to be informed on. My sincere regret for not expressing appreciation to sooner.

  15. nike react说道:

    I want to point out my appreciation for your kind-heartedness supporting those who must have assistance with your area. Your very own dedication to getting the solution all around became exceedingly important and have in most cases empowered many people like me to realize their pursuits. Your amazing insightful tutorial can mean a lot to me and somewhat more to my fellow workers. With thanks; from everyone of us.

  16. reebok outlet说道:

    I have to show my appreciation to you for bailing me out of this particular challenge. After checking throughout the the web and getting suggestions which were not beneficial, I was thinking my entire life was over. Living without the presence of answers to the issues you have sorted out by means of this review is a critical case, as well as the kind which may have in a wrong way affected my career if I had not encountered your web site. The knowledge and kindness in touching everything was very useful. I don't know what I would've done if I had not discovered such a thing like this. I'm able to at this moment look forward to my future. Thank you very much for this specialized and result oriented guide. I will not be reluctant to refer the sites to any individual who should get counselling on this issue.

  17. lacoste outlet说道:

    Thanks a lot for providing individuals with an extremely brilliant possiblity to read critical reviews from here. It's always so amazing and stuffed with a good time for me personally and my office fellow workers to visit your site really thrice in 7 days to learn the newest issues you have got. And indeed, we are usually satisfied with all the eye-popping knowledge you serve. Some 2 points in this posting are really the finest we have ever had.

  18. ultra boost说道:

    Needed to post you a very small observation to be able to thank you so much yet again over the gorgeous opinions you have contributed on this site. It is so surprisingly generous with you to supply unhampered what most of us could possibly have distributed for an electronic book to make some cash on their own, mostly considering the fact that you might have done it in the event you decided. The basics in addition acted to become a great way to know that the rest have a similar fervor like mine to understand a whole lot more around this problem. Certainly there are several more pleasurable times ahead for people who look over your blog.

  19. bape hoodie说道:

    Thank you a lot for providing individuals with an extraordinarily special possiblity to discover important secrets from this website. It is usually so great and packed with a great time for me personally and my office acquaintances to search your web site at a minimum three times in one week to study the new stuff you have. And of course, we are always impressed with your outstanding ideas you serve. Selected 2 tips on this page are in reality the most effective we have all had.

  20. hermes birkin说道:

    I actually wanted to compose a brief message so as to say thanks to you for these awesome advice you are placing on this site. My considerable internet look up has finally been recognized with pleasant strategies to exchange with my great friends. I would state that that most of us readers are rather blessed to dwell in a decent community with many perfect individuals with valuable strategies. I feel somewhat fortunate to have discovered the webpage and look forward to tons of more fun minutes reading here. Thank you once more for everything.

  21. adidas tubular说道:

    I wanted to make a simple comment in order to thank you for all of the unique guidelines you are sharing on this website. My particularly long internet look up has at the end been paid with awesome insight to write about with my co-workers. I would admit that most of us visitors are unquestionably lucky to dwell in a useful community with very many perfect professionals with insightful principles. I feel somewhat blessed to have seen your web site and look forward to really more fun times reading here. Thank you once more for a lot of things.

  22. I enjoy you because of every one of your efforts on this blog. Debby takes pleasure in engaging in investigations and it is easy to see why. Most of us hear all concerning the dynamic means you produce both interesting and useful tactics via this web blog and in addition boost contribution from other individuals on the concern so our favorite girl is now studying a great deal. Take pleasure in the rest of the new year. You are always carrying out a dazzling job.

  23. I enjoy you because of your whole work on this web page. My niece really likes setting aside time for investigations and it's really obvious why. I hear all of the lively ways you convey very helpful solutions on your blog and as well as recommend contribution from some other people about this theme and our favorite daughter is truly discovering a whole lot. Enjoy the rest of the new year. You are always conducting a splendid job.

  24. curry 5说道:

    I am just writing to make you know of the amazing discovery our daughter had using your web page. She picked up some details, which included how it is like to possess an ideal teaching nature to make the rest without hassle fully grasp some hard to do topics. You actually did more than people's desires. Thanks for showing such priceless, healthy, informative and as well as easy guidance on your topic to Ethel.

  25. bape hoodie说道:

    I just wanted to write a small remark to appreciate you for those remarkable advice you are sharing at this website. My time consuming internet lookup has now been rewarded with reliable information to talk about with my company. I 'd suppose that most of us visitors actually are extremely lucky to exist in a very good place with very many brilliant people with beneficial tips and hints. I feel very much privileged to have seen your entire website and look forward to plenty of more amazing times reading here. Thanks a lot again for a lot of things.

  26. nike polo说道:

    Thank you for each of your effort on this blog. My niece delights in setting aside time for investigations and it's obvious why. Almost all know all of the compelling tactic you produce advantageous information through the blog and even strongly encourage participation from others on that situation then our own daughter is always understanding a lot. Take pleasure in the rest of the year. You have been carrying out a wonderful job.

  27. I enjoy you because of all your hard work on this website. My mum take interest in getting into investigations and it's easy to understand why. Many of us know all of the compelling ways you deliver valuable strategies via your web blog and in addition foster contribution from website visitors on the situation and our favorite princess is undoubtedly being taught a lot. Have fun with the rest of the year. You are conducting a good job.

  28. I truly wanted to type a word so as to appreciate you for the unique guidelines you are posting on this site. My extended internet investigation has finally been honored with reasonable ideas to share with my guests. I 'd assume that many of us visitors are quite blessed to dwell in a decent site with so many brilliant individuals with very beneficial concepts. I feel very fortunate to have encountered the web page and look forward to really more awesome minutes reading here. Thanks a lot once again for a lot of things.

  29. nmd说道:

    I intended to put you one little observation just to thank you so much again on your breathtaking suggestions you have discussed here. This has been certainly unbelievably generous with people like you in giving unreservedly what many people could possibly have advertised as an e-book to generate some money for themselves, most importantly since you could have done it if you desired. These things likewise served to provide a easy way to recognize that someone else have similar interest the same as my own to learn good deal more in terms of this problem. I am certain there are many more pleasant situations up front for individuals that read your blog.

  30. I precisely wished to thank you so much again. I am not sure what I would have handled in the absence of the entire suggestions provided by you on such a field. It previously was an absolute difficult matter in my view, but noticing the very skilled avenue you resolved it took me to jump with delight. Now i'm thankful for this advice and even pray you really know what a powerful job you are doing educating the rest through a web site. I am certain you haven't got to know all of us.

  31. ferragamo belts说道:

    I must point out my affection for your generosity in support of people that really want guidance on this subject. Your very own commitment to passing the solution across became rather powerful and have consistently allowed individuals just like me to reach their objectives. Your own interesting instruction indicates much a person like me and still more to my peers. Many thanks; from each one of us.

  32. nike outlet说道:

    Thanks a lot for providing individuals with a very pleasant chance to read in detail from this web site. It can be so good and as well , full of a good time for me personally and my office friends to search the blog not less than thrice in one week to see the new things you have. And definitely, I'm so actually impressed concerning the amazing suggestions served by you. Some 2 tips in this article are completely the finest I've ever had.

  33. I simply had to thank you so much once more. I'm not certain the things I would have carried out in the absence of the actual tactics revealed by you directly on that theme. It seemed to be a real frightening matter in my position, but looking at your well-written mode you resolved the issue took me to weep for delight. I am just happier for this help and as well , sincerely hope you realize what an amazing job that you are providing educating most people with the aid of a site. Most likely you haven't got to know any of us.

  34. nike air force说道:

    I'm also commenting to make you be aware of what a amazing experience my wife's girl experienced browsing your web page. She mastered a lot of issues, not to mention what it is like to have a great coaching style to let many more smoothly have an understanding of a number of tortuous topics. You really exceeded my desires. Many thanks for producing those invaluable, safe, educational and also unique guidance on this topic to Ethel.

  35. yeezy boost 350说道:

    I simply needed to say thanks once again. I am not sure what I could possibly have implemented without the type of hints documented by you on such a area. It has been a real difficult issue in my view, but taking a look at the professional approach you processed it forced me to cry for fulfillment. I am just thankful for this work and as well , have high hopes you realize what a powerful job you are always doing training most people by way of your web site. Most probably you have never come across all of us.

  36. jordan retro说道:

    I'm commenting to let you know of the perfect discovery my friend's child encountered viewing your web site. She even learned several pieces, with the inclusion of how it is like to possess an awesome teaching nature to get certain people easily know various grueling topics. You undoubtedly surpassed visitors' desires. Thank you for giving the great, dependable, revealing and in addition easy thoughts on the topic to Evelyn.

  37. My husband and i were now relieved that Raymond managed to carry out his web research while using the precious recommendations he had through your web pages. It's not at all simplistic just to happen to be giving away facts which other people have been selling. And we realize we now have the writer to appreciate for this. The explanations you've made, the simple site menu, the relationships you will assist to foster - it is all unbelievable, and it's leading our son in addition to the family reason why the theme is enjoyable, which is certainly highly serious. Thank you for all!

  38. Salomon说道:

    Jordan 12 Gym Redhttp://www.jordan12gymred.us.com/
    Nike Outlet satorehttp://www.nikefactoryoutletstoreonline.com/
    nike factory outlet store onlinehttp://www.nikefactoryoutletstoreonline.us/
    Nike Outlethttp://www.nikestores.us.com/
    air jordan 33http://www.jordan33.us/
    Yeezyshttp://www.cheapjerseysfromchina.us/
    custom nfl jerseyshttp://www.customnfljerseys.us/
    jordan 11 concordhttp://www.jordan11concord.us.com/
    Jordan 12 Gym Redhttp://www.jordan12gymred.us/
    Red Jordan 12http://www.redjordan12.us/
    Yeezyshttp://www.yeezy.com.co/
    Yeezyhttp://www.yeezys.us.com/
    Yeezy Supplyhttp://www.yeezysupply.us.com/
    Yeezy Sneakershttp://www.yeezy-shoes.us.com/
    Yeezy Boosthttp://www.yeezy-boost350.com/
    Yeezy Boosthttp://www.yeezyboost350.us.com/
    Yeezy Shoeshttp://www.yeezybluetint.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.com/
    Yeezy 500 Utility Blackhttp://www.yeezy500utilityblack.us/
    Nike Air VaporMaxhttp://www.vapor-max.org.uk/
    Salomonhttp://www.salomon-shoes.org.uk/
    Salomonhttp://www.salomons.me.uk/
    Salomon UKhttp://www.salomonspeedcross4.org.uk/
    Off White Jordanhttp://www.offwhitejordan1.com/
    Vapor Maxhttp://www.nikevapormax.org.uk/
    Nike React Element 87http://www.nikereactelement87.us.com/
    React Element 87http://www.nikereactelement87.us/
    Nike Air Vapormax Plushttp://www.nikeplus.us/
    Nike Outlet Storehttp://www.nike--outlet.us/
    Nike Outlet Storehttp://www.nikeoutletstoreonlineshopping.us/
    Nike Outlet Store Online Shoppinghttp://www.nikeoutletonlineshopping.us/
    NBA Jerseyshttp://www.nikenbajerseys.us/
    Air Max 97http://www.nikeairmax.us/
    Air Max Nikehttp://www.max2017.us/
    Air Jordan Shoeshttp://www.jordan-com.com/
    Jordan 11 Concord 2018http://www.jordan11-concord.com/
    Cheap Yeezy Boosthttp://www.cs7boots1.com/
    Wholesale Cheap NBA Jerseyshttp://www.cheapnba-jerseys.us/
    Birkenstock Sandalshttp://www.birkenstocksandalsuk.me.uk/
    NBA Jerseyshttp://www.basketball-jersey.us/
    Balenciagahttp://www.balenciaga.me.uk/
    Balenciaga UKhttp://www.balenciagauk.org.uk/
    Balenciagahttp://www.balenciagatriples.org.uk/
    Balenciaga UKhttp://www.birkenstocks.me.uk/
    Balenciagahttp://www.balenciagatrainers.org.uk/
    Nike Air Max 270http://www.airmax270.org.uk/
    Adidas Yeezyshttp://www.adidasyeezyshoes.org.uk/
    Yeezy Shoeshttp://www.adidasyeezyshoes.org.uk/

  39. ultra boost说道:

    Thanks a lot for providing individuals with such a terrific chance to check tips from this blog. It's usually very brilliant plus packed with fun for me and my office colleagues to visit your site a minimum of three times a week to find out the new guides you will have. Not to mention, I am at all times astounded with the amazing things you serve. Certain 2 ideas in this article are surely the finest we have all had.

  40. Yeezy Supply说道:

    Air Jordan 12 Gym Redhttp://www.jordan12gymred.us.com/
    nike factory outlet store onlinehttp://www.nikefactoryoutletstoreonline.com/
    Nike Outlet satorehttp://www.nikefactoryoutletstoreonline.us/
    Nike Outlethttp://www.nikestores.us.com/
    jordan 33http://www.jordan33.us/
    Yeezyhttp://www.cheapjerseysfromchina.us/
    nfl jerseyshttp://www.customnfljerseys.us/
    jordan 11 concord 2018http://www.jordan11concord.us.com/
    Jordan 12 Gym Red 2018http://www.jordan12gymred.us/
    Jordan 12 Gym Red 2018http://www.redjordan12.us/
    Yeezyshttp://www.yeezy.com.co/
    Yeezyshttp://www.yeezys.us.com/
    Yeezy Shoeshttp://www.yeezysupply.us.com/
    Yeezy Sneakershttp://www.yeezy-shoes.us.com/
    Yeezy Boost 350 V2http://www.yeezy-boost350.com/
    Yeezy Boosthttp://www.yeezyboost350.us.com/
    Yeezy Shoeshttp://www.yeezybluetint.com/
    Adidas Yeezy 500http://www.yeezy500utilityblack.com/
    Yeezy 500http://www.yeezy500utilityblack.us/
    Nike VaporMaxhttp://www.vapor-max.org.uk/
    Salomon UKhttp://www.salomon-shoes.org.uk/
    Salomon UKhttp://www.salomons.me.uk/
    Salomon Speedcross 4http://www.salomonspeedcross4.org.uk/
    Off White Jordan 1http://www.offwhitejordan1.com/
    Vapor Maxhttp://www.nikevapormax.org.uk/
    Nike React Element 87http://www.nikereactelement87.us.com/
    Nike React Element 87http://www.nikereactelement87.us/
    Nike Vapormax Plushttp://www.nikeplus.us/
    Nike Outlet Storehttp://www.nike--outlet.us/
    Nike Outlet Store Online Shoppinghttp://www.nikeoutletstoreonlineshopping.us/
    Nike Outlethttp://www.nikeoutletonlineshopping.us/
    NBA Jerseyshttp://www.nikenbajerseys.us/
    Air Max 97http://www.nikeairmax.us/
    Air Max 2017http://www.max2017.us/
    Air Jordan Shoeshttp://www.jordan-com.com/
    Jordan 11 Concordhttp://www.jordan11-concord.com/
    Cheap Yeezy Boosthttp://www.cs7boots1.com/
    Cheap NBA Jerseys From Chinahttp://www.cheapnba-jerseys.us/
    Birkenstock Sandalshttp://www.birkenstocksandalsuk.me.uk/
    NBA Jerseyshttp://www.basketball-jersey.us/
    Balenciagahttp://www.balenciaga.me.uk/
    Balenciagahttp://www.balenciagauk.org.uk/
    Balenciaga UKhttp://www.balenciagatriples.org.uk/
    Balenciagahttp://www.birkenstocks.me.uk/
    Balenciaga Trainershttp://www.balenciagatrainers.org.uk/
    Nike Air Max 270http://www.airmax270.org.uk/
    Yeezy Shoeshttp://www.adidasyeezyshoes.org.uk/
    Adidas Yeezy Shoeshttp://www.adidasyeezyshoes.org.uk/

  41. yeezy boost 350说道:

    I simply needed to thank you very much yet again. I'm not certain the things that I would've sorted out in the absence of the entire tips and hints shown by you directly on this situation. It seemed to be a real intimidating issue in my circumstances, but looking at the very well-written strategy you dealt with that made me to weep for contentment. Now i am happy for your assistance and then sincerely hope you recognize what an amazing job you're putting in training the mediocre ones using a site. I am certain you haven't encountered any of us.

  42. curry 4说道:

    My spouse and i got absolutely peaceful that Albert could conclude his reports from the ideas he made from your very own blog. It's not at all simplistic to simply possibly be handing out thoughts that some other people may have been making money from. We really fully understand we now have you to thank because of that. The explanations you've made, the straightforward blog navigation, the friendships you will make it easier to instill - it's got mostly impressive, and it is making our son and the family recognize that this matter is awesome, which is certainly quite fundamental. Thank you for the whole lot!

发表评论

电子邮件地址不会被公开。 必填项已用*标注