Facebook Bug Bounty: Clickjacking

10:14 AM



Note: this is actually a guest post from a friend, Sahad Nk with his recently patched Facebook Clickjacking bug. 

According to OWASP: 

We frame a certain website A within an Iframe and using stylesheets, we made it invisible/hidden (when it exists in the background) and reconstruct another site before it. So while you click something on the attacker controlled site, I can actually make you click a button in the framed website.

The Exploit:

The exploit is really simple and effective; Facebook defends click-jacking in 2 ways. One is an alternative to the other. They also use a technique called Frame-busting (using javascript to deny framing request). On interfaces which don't have a JS support it is sending XFO, not as a
HTTP header, but in a meta tag by putting it in a <noscript> tag

<noscript><meta http-equiv="X-Frame-­Options" content="deny"> </noscript>

Meta-tags that attempt to apply the X-Frame-Options directive DO NOT WORK in all browsers. For example, <meta http-equiv="X-Frame-­Options" content="deny">) will not work. You must apply the X-FRAME-OPTIONS directive as an actual HTTP Response Header. The main point here is browsers ignore what is given in meta tag and do not defend framing, (tested in Firefox 35) but Facebook has an additional JS based frame busting.

On interfaces which require JS support, it is possible to bypass JS frame-busting by putting a sandbox in the iframe like:

<iframe id="clickjacking" src="https://­iphone.facebook.com/­dialog/feed?app_id[APP ID]&picture­=http://example.com/­example.JPG&name=Test­&description=This%20­is%20a%20test&redire­ct_uri=http://­example.com/" width="500" height="500" scrolling="no" frameborder="none" sandbox="allow-forms­"> </iframe>

Simple as that, it was possible to iframe Facebook and make you do many undesirable amount of things. Here is a video demonstrating the seriousness of how this exploit might have been abused:



Reported - March 20
Clarification - March 21
Fix & Bounty  - March 24

thanks,
Sahad Nk

Share This Story

Tags: , ,

You Might Also Like

14 comments

  1. srikanthApril 3, 2015 at 8:24 PM

    nice

    ReplyDelete
  2. UnknownApril 13, 2017 at 12:25 AM

    Thank you for giving this type of nice article.I am very glad to inform you that it is very understand everything that you said.Really i wish to thank you.It is about deadly thesis and you cover everything that related information.It is nice post with understanding a lot.best essay writing service is the better service that provides detailed and effective information related to educational basis.

    ReplyDelete
  3. Candice ClingsJuly 1, 2017 at 3:16 AM

    I enjoy reading a post that can make people think. Also, thank you for allowing for me to comment!
    Shalimar Bagh Hot Escorts

    ReplyDelete
  4. UnknownJuly 11, 2017 at 3:37 AM

    This is great, you are good, i like your post and i still waiting our next post

    Delhi Escort
    Mahipalpur Escorts
    Call Girls in South Ex
    Escorts in Lajpat Nagar
    Escorts in Friends Colony
    Escorts in Greater Kailash

    ReplyDelete
  5. UnknownSeptember 8, 2017 at 3:33 AM

    Hi,Very sensible, your article to take a gander at this is thought. I am particularly captivating this article. I like it. I am forward to another article with you. thankful to you. Anshita Escorts in Gurgaon

    ReplyDelete
  6. UnknownSeptember 12, 2017 at 3:50 AM

    this is actually a guest post from a friend, Sahad Nk with his recently patched Facebook Clickjacking bug. The exploit was really interesting so I really hope you enjoy it. find out best shirts and t-shirts with wide variety of famous brands in cheap rates at Buy Online In Pakistan


    ReplyDelete
  7. UnknownSeptember 12, 2017 at 3:52 AM

    Simple as that, it was possible to iframe Facebook and make you do undesirable amount of things. IT experts, it solutions, IT Experts Agency, Technical Support & IT Solutions, NOC, network monitoring, SEO, PPC, Google Adwords, Graphic Designing IT Experts Agency


    ReplyDelete
  8. UnknownSeptember 12, 2017 at 3:54 AM

    We frame a certain website A within an Iframe and using stylesheets, we made it invisible/hidden (when it exists in the background) and reconstruct another site before it. islamic books

    ReplyDelete
  9. Karen SantiagoOctober 5, 2017 at 4:38 AM

    good

    ReplyDelete
  10. Delhi EscortsNovember 14, 2017 at 3:26 AM

    Escort Service in Delhi.The best escort service provider in Delhi . We provide High Profile Escort Service in Delhi 24/7.
    Delhi Escorts Service
    http://www.delhihotservices.com

    ReplyDelete
  11. avani mehtaNovember 14, 2017 at 3:27 AM

    the escorts in Delhi are really breathtaking companions for you. They gauge from every angle and hug and love you accordingly. While having interaction with them, do not hide anything from them. Let them know what you like and what you do not like. Even if you are novice, you will be provided guidance by them.
    Delhi escort services

    ReplyDelete
  12. Kiya MalhotraNovember 26, 2017 at 10:02 PM

    This comment has been removed by the author.

    ReplyDelete
  13. Kiya MalhotraNovember 26, 2017 at 10:03 PM

    Call now to book your dream date with one of the gorgeous Female Delhi Escorts.
    http://ashikapratt.co.in

    ReplyDelete
  14. Malisha OberoiNovember 30, 2017 at 5:33 AM

    Thanks....when i over read this blog ,too much batter
    l like your blog ,thanks for sharing this to us
    High profile Escort in Delhi

    ReplyDelete

Note: Only a member of this blog may post a comment.