How to Generate a Clickjacking Attack with Burp Suite to Steal User Clicks « Null Byte :: WonderHowTo

Users are often the weakest linkwhen probing for vulnerabilities, and it's no surprise they can be easily fooled. One way to do this is called clickjacking. This type of attack tricks the victim into clicking something they didn't mean to click, something under the attacker's control.Burp Suitecontains a useful tool called Clickbandit to generate a clickjacking attack automatically.Clickjacking OverviewClickjacking is a technique used to trick a user into unknowingly clicking on something using multiple layers, usually a button or link, when intending to click on the top layer. This can be accomplished through the use of hidden iframes, text boxes, or stylesheets. Clickjacking, also called UI redressing, is a portmanteau of the words click and hijacking. Thus, the attacker is essentially hijacking the clicks of the user to perform actions without the user's knowledge.In recent years,Facebook"likes" have been the target of this type of attack and has come to be known as Likejacking. Basically, unsuspecting users would be tricked into liking Facebook pages that they didn't mean to like.In this guide, we will be using the vulnerable virtual machineMutillidae, along withBurp Suite, to demonstrate how to quickly and easily craft a clickjacking attack.Using Clickbandit to Craft an AttackTo get started, we need to fire up Mutillidae and Burp Suite. Next, we will configure Burp to work as aproxyin the browser so we can intercept requests.InFirefox, navigate to "Preferences," and scroll all the way down to the section titledNetwork Proxy. Click on the "Settings" button, select "Manual proxy configuration," and enter127.0.0.1as theHTTP Proxyand8080as thePort. Now, check "Use this proxy server for all protocols," and make sure it is blank underNo Proxy for. Click "OK," and we should be good to go.In Burp, go to the "Proxy" tab and make sure "Intercept is on" is enabled. Next, back in Mutillidae, simply browse to the home page where we will perform the clickjacking attack. We should now see the request appear in Burp.At the top of the window, go to the "Burp" menu, and select "Burp Clickbandit" from the drop-down. A new window will pop up with instructions for using this tool.Following the instructions, click the "Copy Clickbandit to clipboard" button, which will copy thescriptto the clipboard. Next, in the browser, go back to the Mutillidae home page. In Burp, we can either forward the request or turn the intercept feature off to reload the page.Next, we need to access the JavaScript console in the browser. In Firefox, we can right-click and select "Inspect Element," then go to the "Console" tab at the top of the window. We can then paste the script into the console (at the >>) and pressEnter.The Clickbandit banner should now appear at the top of the browser, with options to start and finish the proof of concept. We can also check the "Disable click actions" checkbox so that our clicks will not register while we are recording the attack.Now, all we have to do is perform the series of clicks we want the victim to do. In this case, we will simply click the "Login/Register" button. When finished, click "Finish," and the proof of concept will be presented for review.There are also options here to zoom in or out, toggle transparency, move the iframe position using the arrow keys, or reset the attack. When satisfied, hit the "Save" button to save the proof of concept locally as anHTMLfile for later modification and use.When the attack is performed, and the victim clicks the hidden iframe we inserted, a message appears conveying the vulnerability.At this point, the message can be altered in the HTML file or code can be inserted to perform moremalicious activities.Preventing ClickjackingAlthough clickjacking is not part of theOWASP Top 10, it still poses a significant danger to unsuspecting users. Consequences of this type of attack can include simple website defacement, sensitive data exposure, and deletion of private information. Luckily, there are a couple of easy ways to defend against clickjacking.One of the easiest client-side defenses is to use an extension likeNoScript, which contains a feature to prevent users from clicking on invisible or embedded objects.Another more robust approach is to employ the use of Content Security Policy frame-ancestors, a sort of successor to the X-Frame-Options header, to disallow framing from other potentially malicious domains. Yet another defense against clickjacking is to simply ensure that there is code in place to make the current frame the top-level window of the UI at all times.Wrapping UpClickjacking can be a valuable means of attack in the right situations, but it is often time-consuming to manually craft an attack. Burp Suite includes a feature called Clickbandit to automate this process, making it effortless to generate an attack. Once a proof-of-concept is created and a vulnerability is proven to exist, all it takes is some imagination to customize it for an easy point and click hack.Don't Miss:Attack Web Applications with Burp Suite & SQL InjectionFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image byFree-Photos/Pixabay; Screenshots by drd_/Null ByteRelatedHow To:Use Burp & FoxyProxy to Easily Switch Between Proxy SettingsHack Like a Pro:How to Hack Web Apps, Part 4 (Hacking Form Authentication with Burp Suite)How To:Leverage a Directory Traversal Vulnerability into Code ExecutionHow To:Hack Facebook & Gmail Accounts Owned by MacOS TargetsHow To:Discover XSS Security Flaws by Fuzzing with Burp Suite, Wfuzz & XSStrikeHack Like a Pro:How to Hack Web Apps, Part 3 (Web-Based Authentication)Hack Like a Pro:How to Crack Online Web Form Passwords with THC-Hydra & Burp SuiteHow To:Hack SAML Single Sign-on with Burp SuiteHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)How To:Bypass File Upload Restrictions Using Burp SuiteHow To:Break into Router Gateways with PatatorHacking Windows 10:How to Hack uTorrent Clients & Backdoor the Operating SystemHow To:Attack Web Applications with Burp Suite & SQL InjectionHack Like a Pro:Digital Forensics for the Aspiring Hacker, Part 1 (Tools & Techniques)How To:Correctly burp a babyHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:The Paranoid Mac Owner's Guide to Defeating Remote Snooping & Evil Maid AttacksNews:'Impossible to Identify' Website Phishing Attack Leaves Chrome & Firefox Users Vulnerable (But You Can Prevent It)How to Hack Windows 7:Sending Vulnerable Shortcut FilesHack Like a Pro:How to Bypass Antivirus Software by Disguising an Exploit's SignatureSubterfuge:MITM Automated Suite That Looks Just Lame.Hacking Android:How to Create a Lab for Android Penetration TestingHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsHow To:Generate Word-Lists with Python for Dictionary AttacksHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)News:Easy Skype iPhone Exploit Exposes Your Phone Book & MoreHow To:How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against ItNews:CELTX - Free media pre-production toolsNews:WordPress Click-jacking AttackNews:Indie and Mainstream Online Games Shut Down by LulzSecNinja Saga Tutorial:User Interface MapsHow To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsNews:The Myths of Limited WarHow To:Use Wireshark to Steal Your Own Local PasswordsHow To:How Hackers Steal Your Internet & How to Defend Against ItNews:How-To-Generate Thousands Of Valid Email IDs