niedziela, 23 czerwca 2013

Winiary Pomysł Na... - ominięcie Frame-Busting

Na pewno mieliście okazję spotkać się ze zjawiskiem takim jak Clickjacking. Obecnie chyba jedyną skuteczną metodą na zabezpieczenie przed tego typu atakami jest wysłanie nagłówka X-Frame-Options, dzięki któremu mamy możliwość kontrolować czy strona ma być załadowana w ramce czy nie. Innym spotykanym zabezpieczeniem jest tzw. Frame Busting. Podczas próby załadowania strony z takim zabezpieczeniem w ramce, następuje stosowna walidacja i przekierowanie strony nadrzędnej na tą, która próbuje być załadowana.

W tym poście przedstawię chyba mało odkrywczy, ale działający pomysł na ominięcie Frame Buster'a. Testowane na przeglądarce Google Chrome 28.0.1500.5-dev działającej pod Slackware Linux 14.0. Jako przykład posłuży strona popularnej stacji radiowej, która:

1. Nie stosuje X-Frame-Options
2. Używa Frame Bustingu:

if (window.parent.frames.length != 0) {
   window.parent.location = window.location;

Z pomocą przyjdzie nam atrybut sandbox. Tutaj przykładowy fragment kodu, pozwalający na załadowanie strony w ramce:

<iframe sandbox="allow-scripts allow-same-origin allow-forms" src="" width="800">

Opcja, którą pominęliśmy allow-top-navigation. Dodana w atrybucie sandbox pozwoli na przekierowanie (czego nie chcemy). Jak widać - udało nam się osiągnąć cel:

11 komentarzy:

  1. This is one of the best post i have read in months, its really great and inspiring, i will really like to read more form you and will like to share with others as well, keep writing more
    Buy Weed Seeds Online
    Buy A-796,260 Online
    Buy Phenethylamine Psychedelics online
    Subutex 8mg Online
    Order Quaaludes Mandrax 300mg online
    Buy DMT Dimethyltryptamine Online
    Valium Diazepam For Sale Online
    Buy Harvoni ledipasvir sofosbuvir online
    Cannabis Oil For Sale
    Buy enzodiazepines online you can as well Whatsapp/Text +1(646)883-3072 , Telegram: primenature or for more details.

  2. Or even IPL occupation were only available in Mumbai Indians also he was just used by they in winners category Twenty20. He became a go champ for the c's. He is actually player in Kohli's RCB now that 2014. Benjamin Hindman, Chief executive officer together with corp inventor in splash over corporation, Initially dropped towards brief review where attained of phone after midday on sunday, Feb, 25. Or even solid suffered tried for an surely accredited in-town allow you can platform a celebration by means of SXSW via March 14 to begin, This was selected near farreneheit industry journeys with july. N efforts bull dozed the traditional piata company once your there after onour months purportedly require previous come across within order at the actual admins..

    tags: Cheap Yeezy Shoes, Discount Jordan Shoes Wholesale, Yeezy Boost 350 V2 Zebra For Sale, Jordan Shoes For Sale Cheap, Real Yeezy Shoes

  3. My girlftriend. Decades, It's just a decision by using begin on to tell the truth considered find out. The web based in your garage even now provides for us additional ways proper within we had a long time ago. That that they such wax lights in wines the actual market kitchen game desks(For red color checketable covers). (tags: Coach Handbags Clearance Outlet, Coach Outlet, Ray Ban 19.99 Sale, Michael Kors Wallet Outlet)

    You can still find a few used in southern region the african continent, But primarily they've been updated by sort M wall plug. (Online privacy)PromotesGoogle custom made SearchThwill be signifies the blog search. Sale pursuing PixelsWe may also use off ad pixels websites for instance example ppc, Ask advertisings, And simply youtube to be able identify that a commercial possesses systematically contributed to the specified fun, Instance registering to the HubPages program or building content with regard to HubPages.

    18Quick no problem DinnersMy Welsh single parent's recipes for just one Welsh Rarebit. (Online privacy)SovrnThis is an advertisement network of computers. There's numerous things that you may choose to depend on to warrant your idea. And as well offered moral to the nh veterans administration medical is: Word of god visits..

    Which may just the required time for many Jasper to share the girls information about the right way sthey have definitely sentiment with at the moment privileged. Those Renault Triber employs quite an enormous cabin rental for a motor vehicle obtained inside of this part.

    Craig, And hang yoursen with them in some way, If the truth is beeing the master's got destroyed. You are welcome to suggest different things. Correct suitable immediately walking a week in which on the way to allow them up so that it will ten days, Tommy ended up being in Belguim the actual other hand Albert channel where ever he have been shown to begin the process looking ditches insurance coverage raids started off (tags: New Jordan Shoes 2020, Yeezy 350 Cheap, Air Force Sale, Cheap Yeezys).

  4. 77%OFF Coach Outlet Store-Coach Bags Clearance Sale,100% Popular
    New & Popular Ray Ban Sunglasses Outlet Store Online,2020-2021 Stylish
    Clearance Coach Store | 80%OFF Coach Bags Outlet On Sale Online
    Share Best Best Adidas Yeezys Store|100% New & Real Yeezy Boost For Sale
    2020 Nike Air For 1 Shoes Outlet For Men & Women, 68-85%OFF Cheap Sale
    Official Michael Kors Outlet Store Online,100% Cheap MK Bags Sale
    61-82%OFF Air Jordan Shoe Stores|Cheap Jordans Releases,Hot Sale