Make Profit with UI-Redressing AMol NAik http://amolnaik4.blogspot.com
Agenda UI-Redressing Server-Side Mitigations How to make Profit? What to Target? Tools to Hack CSS Basics Exploitation Techniques Conclusion
UI-Redressing Change User Interface in browser Victim clicks button on attacker site He/she actually clicking button on Vulnerable siteSource: http://www.imperva.com/resources/glossary/clickjacking_ui-redressing.html
UI-Redressing Mostly neglected by vendors Why? – Need user interaction Browser dependancy Impact: Same as CSRF One click – GONE!! Bypass CSRF protections Exploit “Self-XSS” Cross-domain Content Extraction
Server-Side Mitigations X-Frame-Options Response Header Supported by most of the latest browsers Two possible values to use: DENY The page cannot be displayed in a frame, regardless of the site attempting to do so SAMEORIGIN The page can only be displayed in a frame on the same origin as the page itself.
How to make Profit? Bug Bounties Google Pays from $500 to $3133.7 XSS, CSRF are prime focus Name will be listed in Google Security Hall of Fame http://www.google.com/about/corporate/company/halloffame.html Facebook Starting from $500 XSS, CSRF, Open Redirect, Database Injection Name will be listed in Facebook WhiteHat http://www.facebook.com/whitehat
What to Target? CSRF protected actions Pages with tokens Self-XSS
Tools to Hack Browser I use Add-ons Clickjacking Defense – Declarative Security Created by Aditya k Sood Check for “X-Frame-Options” Firebug Many uses CSS editing On-the-Fly
CSS Basics Opacity Set Transparency for the element Top, Left Negative values shift elements out of the browser window Position Specifies the type of positioning method used for an element Static (default) - The box is a normal box. The top, right, bottom, and left properties do not apply. Relative - The boxs position is calculated according to the normal flow Absolute - The boxs position is specified with the top, right, bottom, and left properties Fixed - The boxs position is calculated according to the absolute model, but in addition, the box is fixed.