Skip to content

Commit

Permalink
finish clickjacking
Browse files Browse the repository at this point in the history
  • Loading branch information
@YuZhang
YuZhang committed Dec 7, 2016
1 parent 39d1af6 commit 7f873c8
Show file tree
Hide file tree
Showing 12 changed files with 240 additions and 46 deletions.
2 changes: 1 addition & 1 deletion buffer-overflow/buffer-overflow-3.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -490,7 +490,7 @@ stop gadget是一个指向令程序停止代码（例如`sleep()`）的返回地
```

这会将`pause()`调用号存入寄存器中。若其中有`exa`，而且`syscall()`猜测正确的话，则服务器会暂停。此时，就找到了`syscall()`地址。接着，用每个pop gadget单独重复这一过程，就能找到使用了`exa`的gadget。利用该方法的原理还可以确定其他寄存器对应的gadget。
这会将`pause()`调用号存入寄存器中。若其中有`eax`，而且`syscall()`猜测正确的话，则服务器会暂停。此时，就找到了`syscall()`地址。接着，用每个pop gadget单独重复这一过程，就能找到使用了`eax`的gadget。利用该方法的原理还可以确定其他寄存器对应的gadget。

- 第4步：调用`write()`

Expand Down
2 changes: 1 addition & 1 deletion readme.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@
- [分布式拒绝服务(DDoS)](network-security/ddos.md) (Shrew, IP-Traceback)
- [Web安全](web-security)
1. [注入，XSS与CSRF](web-security/web-sec-1.md)
- [认证，Clickjacking与Tracking](web-security/web-sec-2.md)
- [认证与Clickjacking](web-security/web-sec-2.md)
- [SSL/TLS安全](web-security/tls.md)（BEAST, CRIME, POODLE, 3HS...）
- [新进展（待）]()
1. 匿名通信（Tor，）
Expand Down
7 changes: 1 addition & 6 deletions system-security/capabilities-sandbox.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@

###基于能力的安全

[基于能力（capability）的安全](https://en.wikipedia.org/wiki/Capability-based_security) ：一个能力是一个可交换但不可伪造的权威令牌（token），实现为一个引用(reference)指向一个受保护对象及相关访问权利（right）。
[基于能力（capability）的安全](https://en.wikipedia.org/wiki/Capability-based_security) ：一个能力是一个可交换但不可伪造的权威令牌（token），实现为一个引用（reference）指向一个受保护对象及相关访问权利（right）。

**一个文件访问控制例子：**

Expand Down Expand Up @@ -224,8 +224,3 @@ FreeBSD Capsicum 100 Capsicum sanboxing using cap_enter

```
---
I
Expand Down
15 changes: 7 additions & 8 deletions system-security/privilege-separation.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -116,18 +116,19 @@ Unix系统采用强制访问控制，**‘root’**特权用户（UID=0）拥有
- 缺省情况下，例如登录后`euid = ruid = suid`
- `euid`：进程多数权限依赖于`euid`，例如新创建文件的拥有者。`euid=0`的进程为特权进程。(Linux中还有`fsuid`)
- `ruid`：进程真正拥有者（启动者），拥有发信号权限
- `suid`：临时保存`euid`，待之后恢复。用于特权用户临时降低特权，之后再恢复特权。
- `suid`：临时保存`euid`，待之后恢复。用于特权用户临时降低特权，之后再恢复特权
- Linux中的`fsuid/gid`用于文件系统访问控制，通常与`euid/gid`一致
- 进程`fork`或`exec`时，继承或保留3个uid
- `setuid`调用：实际情况比较复杂，详见[Setuid Demystified (2002)](supplyments/setuid-usenix02.pdf)
- `setuid()`函数族设置`uid/gid`，但实际情况比较复杂，详见[Setuid Demystified (USENIX Security 2002)](https://www.usenix.org/legacy/events/sec02/full_papers/chen/chen.pdf)
- `sudo`命令：临时以特定用户（缺省root）特权来执行命令。例如，`sudo apt-get`
- [`chroot`](https://en.wikipedia.org/wiki/Chroot)命令：
- 该命令只有root可以执行：`chroot /tmp/guest`, `su guest`
- 改变当前进程的根目录，将进程文件系统特权限制在指定jail目录下
- `open("/etc/passwd", "r")` -> `open("/tmp/guest/etc/passwd", "r")`

[特权扩大（priviledge escalation）](https://en.wikipedia.org/wiki/Privilege_escalation)：利用操作系统或软件应用中的bug、设计缺陷或配置疏漏来获得访问被保护资源的特权。

- 垂直特权扩大：即特权提升（priviledge elavation），低特权用户获得高特权用户的特权，通常获得系统管理权。例如，Unix系统中越狱(jailbreakig)打破`chroot`或`jail`限制，以及Andriod中获取root。
- [`chroot`](https://en.wikipedia.org/wiki/Chroot)命令：
- 该命令只有root可以执行：`chroot /tmp/guest`, `su guest`
- 改变当前进程的根目录，将进程文件系统特权限制在指定jail目录下
- `open("/etc/passwd", "r")` -> `open("/tmp/guest/etc/passwd", "r")`
- 水平特权扩大：一个用户获得另一用户的特权。例如，在一个网银中，用户甲通过cookie劫持来访问用户乙的银行账户。

[**最小特权原则（principle of least privilege）**](https://en.wikipedia.org/wiki/Principle_of_least_privilege)：限制每个主体只具有执行合法操作所必须的最小特权。
Expand Down Expand Up @@ -219,5 +220,3 @@ OKWS安全缺点：
- 仍然受核心库中bug影响

---

I
Expand Down
Binary file added web-security/supplyments/busting-frame.pdf
View file
Binary file not shown.
15 changes: 0 additions & 15 deletions web-security/supplyments/clickjacking-1.html
View file

This file was deleted.

45 changes: 45 additions & 0 deletions web-security/supplyments/clickjacking-example/attacker.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
<html>
<head>
<title>Attacker web page</title>
<script type="text/javascript">
function win_open() {
window.open("attacker.html");
}
/* framebluster */
/* if (top.location != self.location)
top.location = self.location; */
</script>
<style type="text/css"><!--
*{
margin:0;
padding:0;
}
body {
background:#ffffff;
}
.button
{
padding:5px;
background:#6699CC;
left:275px;
width:120px;
border: 1px solid #336699;
}
#content {
width: 200px;
height: 200px;
margin-top: 50px ;
margin-left: 50px;
}
//--></style>

</head>
<body>
<div id="content">
<h1>Attacker</h1>
<form action="attacker.html">
<input type="button" class="button" value="Go to the attacker!" onclick="javascript:win_open()">
</form>
</div>
</body>
</html>
Binary file added web-security/supplyments/clickjacking-example/autofill.jpg
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
73 changes: 73 additions & 0 deletions web-security/supplyments/clickjacking-example/clickjacking.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
<html>
<head>
<title>Trusted</title>
<script>

/* framebluster */

/* window.onbeforeunload = function ()
{
return "Asking the user nicely";
}*/

function win_open() {
window.open("attacker.html");
}
</script>

<style type="text/css"><!--
*{
margin:0;
padding:0;
}
body {
background:#ffffff;
}
.button
{
padding:5px;
background:#6699CC;
left:275px;
width:120px;
border: 1px solid #336699;
}
#content {
width: 200px;
height: 200px;
margin-top: 50px ;
margin-left: 50px;
}
#clickjacking
{
position: absolute;
left: 0px;
top: 110px; /* from 110 to 50 */
opacity:0.0; /* from 0.0 to 0.5 */
}
//--></style>

</head>
<body>
<h1>Example 1: onMouseUp</h1>
<a onMouseUp="win_open()"
href="trusted.html"/>
Go to the Trusted!</a>
</br>
</br>
<h1>Example 2: iframe</h1>
<div id="content">
<h1>Trusted</h1>
<input type="button" class="button" value="Go to the trused!">
</div>
<iframe id="clickjacking" src="attacker.html" width="200" height="200" scrolling="no" frameborder="none">
</iframe>
</br>
</br>
<h1>Example 3: cursorjacking</h1>
<img src="cursorjacking.jpg" alt="cursorjacking" height="400" width="800"/>
</br>
</br>
<h1>Example 4: autofill</h1>
<img src="autofill.jpg" alt="autofill" height="400" width="500"/>
</body>
</html>
Binary file added web-security/supplyments/clickjacking-example/cursorjacking.jpg
View file
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
8 changes: 8 additions & 0 deletions web-security/supplyments/clickjacking-example/trusted.html
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<html>
<head>
<title>Trusted</title>
</head>
<body>
<p>This website is trusted!</p>
</body>
</html>
119 changes: 104 additions & 15 deletions web-security/web-sec-2.md
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
#Web安全：Phishing、Clickjacking与Tracking
#Web安全：Phishing与Clickjacking

###哈尔滨工业大学 网络与信息安全 张宇 2016

Expand Down Expand Up @@ -84,6 +84,13 @@ response_type=code&scope=get_user_info%2Cadd_share

[Clickjacking](https://en.wikipedia.org/wiki/Clickjacking)：也称作“User Interface redress attack”，欺骗用户鼠标点击一个对象，该对象与用户本以为要点击的不同。

演示：[POC网页与攻击截图](supplyments/clickjacking-example/clickjacking.html)

- 例1：利用Javascript更改用户点击后触发的动作
- 例2：利用iframe覆盖实际访问的网页，绕过同源规则（Same origin）
- 例3：cursorjacking，用假鼠标指针欺骗用户点击不同位置
- 例4：[Password Managers: Attacks and Defenses (USENIX Security 2014)](https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/silver)：通过iframe包含敏感登录网页，截获口令管理器自动填充的口令

攻击效果：

- 欺骗用户一键购物
Expand All @@ -93,28 +100,110 @@ response_type=code&scope=get_user_info%2Cadd_share
- 关注某人，分享链接，点赞
- 点击广告来产生pay per click收入

一个例子，看上去是谷歌，点击打开百度，[源文件](supplyments/clickjacking-1.html)：
###Framebluster

```html
<html><head>
<title>Google</title>
<script>
function win_open() {
window.open("http://www.baidu.com");
参考资料：[Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites (IEEE Web 2.0 S&P workshop 2010)](supplyments/busting-frame.pdf) [[online]](http://seclab.stanford.edu/websec/framebusting/)

[Framebuster](https://en.wikipedia.org/wiki/Framekiller)：（Frame Busting, framekiller）：通过嵌入脚本来阻止网页被其他网页framing

framebluster脚本通常有以下模式：先判断自己是否被嵌套，若是则采取对策

```javascript
if (top.location != self.location)
top.location = self.location;
```
演示：将framebuster应用于[被嵌套网页](supplyments/clickjacking-example/attacker.html)

下面介绍若干针对framebluster的攻击：

- Double framing：通过双重framing来绕过基于`parent.location`的防御方法，例如

```javascript
if (top.location != self.location) { parent.location = self.location;
}
</script></head>
<body>
<a onMouseUp="win_open()" href=http://www.google.com/>
Go to Google</a>
</body></html>
```

一个基于`iframe`的例子：
- `onBeforeUnload`事件：当framing网页将要被卸载时会触发`onBeforeUnload`事件，通过注册一个事件句柄来让用户取消掉framebluster的对策。PayPal曾存在该漏洞。

```javascriptwindow.onbeforeunload = function ()
{ return "Asking the user nicely";
}
```
演示：应用`onBeforeUnload`事件来绕过之前的framebuster，[POC](supplyments/clickjacking-example/clickjacking.html)
- 利用XSS过滤器：浏览器为防御XSS攻击过滤恶意脚本，可利用该机制来过滤framebluster
```javascript
framebluster:
if (top != self) { top.location=self.location;}
Attacker:<iframe src="http://www.victim.com/?v=if(top+!%3D+self)+%7B+top.location%3Dself.location%3B+%7D">
```
- Referer检查问题：`referer`属性返回载入当前文档的文档，利用`referer`实现的framebluster可能存在漏洞。沃尔玛和纽约时报网站曾存在该漏洞。

```javascript
if (top.location != location) {
if (document.referrer && document.referrer.indexOf(”walmart.com”) == −1) { top.location.replace(document.location.href);
}}
```

攻击者通过域名`walmart.com.badgy.com`来绕过上面的防御。

```javascript
if (window.self != window.top &&
!document.referrer.match( /https?:\/\/[ˆ?\/]+\.nytimes\.com\//)) { top.location.replace(window.location.pathname);}
```

由于上述检查没有从头检查，攻击URL中只要包含`https://www.nytimes.com/`就能绕过。

- 域名检查错误：USBank通过referer域名来检查是否被framed

```javascript
if (self != top) {var dom = getDom(document. referrer );
var okDom = /usbank|localhost|usbnet/;
var matchDomain = dom.search(okDom);

if (matchDomain == −1) { //bust }
```
挪威state house银行(http://www.husbanken.no)和莫斯科银行(http://www.rusbank.org)也能通过检查
- IE Restricted Zone：通过浏览器来禁用javascript来关闭framebluster
```html
<iframe src=”http://www.victim.com” security=”restricted”></iframe>
```
[Framebluster最佳实践](https://www.codemagi.com/blog/post/194):
在文档HEAD结尾定义一个style来禁止显示网页：
```htmls
<style id="antiClickjack">body{display:none !important;}</style>
```
在文档BODY结尾执行flamebluster脚本：若未被framed，则显示网页（移除禁止显示网页的style）；若被framed，则将自己设置为顶层。
```javascript
if (self === top) {
var antiClickjack = document.getElementById("antiClickjack");
antiClickjack.parentNode.removeChild(antiClickjack);
} else {
top.location = self.location;
}
```
若javascript被禁用，则缺省情况下网页不会被显示。
###其他防御方案：
##3. Tracking
- [NoScirpt](https://en.wikipedia.org/wiki/NoScript)中的ClearClick功能阻止用户点击那些不可见或被修改的网页元素
- X-Frame-Options：允许一个网页通过在HTTP应答头部添加新选项来说明frame策略 [RFC7034: HTTP Header Field X-Frame-Options](https://tools.ietf.org/html/rfc7034)
- `SAMEORIGIN`：只允许显示在同源网站的frame中
- `DENY`：禁止被显示在frame中
- `ALLOW-FROM`：只允许显示在指定网站的frame中
- [Content Security Policy](https://en.wikipedia.org/wiki/Content_Security_Policy)：实现类似X-Frame-Options的机制，通过`frame-ancestors`来说明允许被嵌入哪个起源网页，例如`Content-Security-Policy: frame-ancestors 'none'`将禁用iframe
- 通过高亮等方式确保指针的视觉完整性
---
Expand Down

0 comments on commit 7f873c8

Please sign in to comment.