Gratipay · Report #123782

Vulnerable to clickjacking

Informativestatus

2upvotes

13 May 2016disclosed

How it was found

Reproduction steps:

1.Open URL :https://grtp.co/ 2.put the url in the below code of iframe

<html> <head> <title>Clickjacking GRTP</title> </head> <body> <p>Website is vulnerable to clickjacking!</p> <iframe src="https://grtp.co/" width="500" height="500"></iframe> </body> </html> 3.Observe that site is getting displayed in Iframe

Impact: By using Clickjacking technique, an attacker hijack's click's meant for one page and route them to another page, most likely for another application, domain, or both.

Standard: SANS CWE-693

Remediation: Frame busting technique is the better framing protection technique. Sending the proper X-Frame-Options HTTP response headers that instruct the browser to not allow framing from other domains

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original