Yelp · Report #168358

Clickjacking: X-Frame Header Missing

Informativestatus

2upvotes

9 Nov 2017disclosed

How it was found

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

CODE:

<html> <head> <title>Clickjack test page</title> </head> <body> <p>Website is vulnerable to clickjacking!</p> <iframe src="http://yelp.com" width="500" height="500"></iframe> </body> </html>

For More : https://www.owasp.org/index.php/Testing_for_Clickjacking_(OWASP-CS-004)

Proof attatched !

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original