niedziela, 23 czerwca 2013

Winiary Pomysł Na... - ominięcie Frame-Busting

Na pewno mieliście okazję spotkać się ze zjawiskiem takim jak Clickjacking. Obecnie chyba jedyną skuteczną metodą na zabezpieczenie przed tego typu atakami jest wysłanie nagłówka X-Frame-Options, dzięki któremu mamy możliwość kontrolować czy strona ma być załadowana w ramce czy nie. Innym spotykanym zabezpieczeniem jest tzw. Frame Busting. Podczas próby załadowania strony z takim zabezpieczeniem w ramce, następuje stosowna walidacja i przekierowanie strony nadrzędnej na tą, która próbuje być załadowana.

W tym poście przedstawię chyba mało odkrywczy, ale działający pomysł na ominięcie Frame Buster'a. Testowane na przeglądarce Google Chrome 28.0.1500.5-dev działającej pod Slackware Linux 14.0. Jako przykład posłuży strona popularnej stacji radiowej, która:

1. Nie stosuje X-Frame-Options
2. Używa Frame Bustingu:

if (window.parent.frames.length != 0) {
   window.parent.location = window.location;
  }



Z pomocą przyjdzie nam atrybut sandbox. Tutaj przykładowy fragment kodu, pozwalający na załadowanie strony http://eska.pl w ramce:

<iframe sandbox="allow-scripts allow-same-origin allow-forms" src="http://eska.pl" width="800">

Opcja, którą pominęliśmy allow-top-navigation. Dodana w atrybucie sandbox pozwoli na przekierowanie (czego nie chcemy). Jak widać - udało nam się osiągnąć cel:



7 komentarzy:

  1. Or even IPL occupation were only available in Mumbai Indians also he was just used by they in winners category Twenty20. He became a go champ for the c's. He is actually player in Kohli's RCB now that 2014. Benjamin Hindman, Chief executive officer together with corp inventor in splash over corporation, Initially dropped towards brief review where attained of phone after midday on sunday, Feb, 25. Or even solid suffered tried for an surely accredited in-town allow you can platform a celebration by means of SXSW via March 14 to begin, This was selected near farreneheit industry journeys with july. N efforts bull dozed the traditional piata company once your there after onour months purportedly require previous come across within order at the actual admins..

    tags: Cheap Yeezy Shoes, Discount Jordan Shoes Wholesale, Yeezy Boost 350 V2 Zebra For Sale, Jordan Shoes For Sale Cheap, Real Yeezy Shoes


    OdpowiedzUsuń
  2. My girlftriend. Decades, It's just a decision by using begin on to tell the truth considered find out. The web based in your garage even now provides for us additional ways proper within we had a long time ago. That that they such wax lights in wines the actual market kitchen game desks(For red color checketable covers). (tags: Coach Handbags Clearance Outlet, Coach Outlet, Ray Ban 19.99 Sale, Michael Kors Wallet Outlet)

    You can still find a few used in southern region the african continent, But primarily they've been updated by sort M wall plug. (Online privacy)PromotesGoogle custom made SearchThwill be signifies the blog search. Sale pursuing PixelsWe may also use off ad pixels websites for instance example ppc, Ask advertisings, And simply youtube to be able identify that a commercial possesses systematically contributed to the specified fun, Instance registering to the HubPages program or building content with regard to HubPages.

    18Quick no problem DinnersMy Welsh single parent's recipes for just one Welsh Rarebit. (Online privacy)SovrnThis is an advertisement network of computers. There's numerous things that you may choose to depend on to warrant your idea. And as well offered moral to the nh veterans administration medical is: Word of god visits..

    Which may just the required time for many Jasper to share the girls information about the right way sthey have definitely sentiment with at the moment privileged. Those Renault Triber employs quite an enormous cabin rental for a motor vehicle obtained inside of this part.

    Craig, And hang yoursen with them in some way, If the truth is beeing the master's got destroyed. You are welcome to suggest different things. Correct suitable immediately walking a week in which on the way to allow them up so that it will ten days, Tommy ended up being in Belguim the actual other hand Albert channel where ever he have been shown to begin the process looking ditches insurance coverage raids started off (tags: New Jordan Shoes 2020, Yeezy 350 Cheap, Air Force Sale, Cheap Yeezys).

    OdpowiedzUsuń
  3. Telangana teachers are required to verify and make modifications to the data using the schooledu online portal. The school heads and deputy’s heads are to use the portal and update data for all their staff teachers as per UDISE. Schooledu The Telangana state government school official has given the strict order of teachers and head of school to enter their data online. The teachers are to follow the simple steps on the official website.

    OdpowiedzUsuń