Clickjacking and Redirection Gaps

Clickjacking and Redirection Gaps

they are totally undetectable attacks by antivirus and other cleaning programs, only an informed and aware user is able to thwart them.
Clickjacking is therefore about using the click of your mouse for other, potentially malicious purposes.
Likejacking is a word derived from "Like" and ClickJacking referring to the use of click hijacking to ensure that people like Facebook pages without their knowledge.
You should know that some malicious sites use the clickjacking technique to place an invisible "Like" button that automatically follows your mouse.
The Likejacking is only one example among others, we can very well imagine the fact of clicking on the Internet button to allow access to the WebCam.
We can also imagine that it is possible to change the parameters of a Facebook account, we can also imagine that it is possible to forward someone on Twitter ... etc.
And finally, we could very well apply the ClickJacking CSRF flaw, result: One can potentially hack a website.

security measures

ClickJacking is hard to spot, and not everyone will look at the source code of each page visited to ensure that no malicious script is running.
Moreover, fighting ClickJacking effectively would be like disabling the scripts of your browser. The solution is not conceivable.
Fortunately we have a small solution that is looming, it is the use of the NoScript addon with the ClearClick option that protects against clickjacking. NoScript allows you to leave all the scripts activated but to keep the anti-clickjacking protection, and here we are! Info and download here, more info here.
Regarding the protection of the website, again it is possible to prevent a site from appearing in an iframe (so in the form of "invisible button"), but again this is not ideal because many services would like to use a site in an iframe in a legitimate way.
That said, the information is here for Apache and there for IIS7.
What are redirection faults?
Redirection failures are not used to power your WebCam or follow someone on a social network, but are instead used to perform phishing attacks.
The concept is similar: It makes the user believe that he will go to a legitimate site while he is directly redirected to another site.
Although the behavior is in theory normal (a given site has the right to link to another site), it can be used maliciously.
Let's take the example of last year on the Facebook redirect flaw:
Imagine that the following link is always functional:
http://apps.facebook.com/fifaccebcbdb/0/preload.aspx?fb_force_mode=iframe&l=http://www.google.com
What would happen after clicking?
Answer: We end up directly on Google! (note the "http://www.google.com" at the end).
While the beginning of the link corresponds to apps.facebook.com, it could have even been facebook.com.
Note in addition that it is often possible to truncate the links of the following kind:
http: //apps.facebook.com/fifaccebcbdb/0/preload.aspx fb_force_mod ...?
Imagine that the destination site is not Google, but a copy of Facebook: The user connects believing to be on Facebook, his password is immediately recovered and he does not even realize it.
This type of fault exists in many well-known websites that we use every day ... This is a flaw that is not really considered as "Defect" yet ...