bitsongofficial / sinfonia-ui

6 stars 11 forks source link

[Competition Bug]: Missing Anti-clickjacking 2 (With Details Solutions) #235

Closed GalihNugraha22 closed 2 years ago

GalihNugraha22 commented 2 years ago

Prerequisites

Describe the exact steps to reproduce the problem in as many details as possible

1. Client-side Protection: Frame Busting (Solution 1) The most common client-side method, that has been developed to protect a web page from clickjacking, is called Frame Busting and it consists of a script in each page that should not be framed. The aim of this technique is to prevent a site from functioning when it is loaded inside a frame.

Target site frame busting code (example.org):

if(top.location!=self.locaton) { parent.location = self.location; }

Attacker’s top frame (fictitious2.html):