Welcome! Log In Create A New Profile

Re: (Semi-OT) Clickjacking countermeasure

Forum List Message List New Topic Print View

c0nw0nk

September 22, 2016 04:57PM

Registered: 10 years ago
Posts: 210

If you read the OWASP page it will also mention about header stripping etc and proxies that will remove the X-Frames headers there is no real way to stop proxies framing your site but the X-Frame-Options combined with that JavaScript is a good way to start it will stop the majority.

Also break their proxies is what I like to do.

For example I combine it with not allowing people to browse with JavaScript disabled. (this is good for adverts too since ads use JavaScript so why would you let people browse with JavaScript disabled ?)

<head>
<noscript><meta http-equiv="refresh" content="0; URL=//www.networkflare.com/error.html"/></noscript>
</head>

There are some proxies that will still get through for example this one shows persistence but block their IP's and problem solved https://www.hidemyass.com/proxy

http://www.networkflare.com/

Reply Quote

RSS

Subject	Author	Posted
(Semi-OT) Clickjacking countermeasure	gariac	September 22, 2016 03:30PM
Re: (Semi-OT) Clickjacking countermeasure	c0nw0nk	September 22, 2016 04:34PM
Re: (Semi-OT) Clickjacking countermeasure	gariac	September 22, 2016 04:50PM
Re: (Semi-OT) Clickjacking countermeasure	c0nw0nk	September 22, 2016 04:57PM
Re: (Semi-OT) Clickjacking countermeasure	gariac	September 22, 2016 05:08PM

Sorry, only registered users may post in this forum.

Click here to login

Online Users

ZiqianXu

Guests: 305

Record Number of Users: 8 on April 13, 2023

Record Number of Guests: 421 on December 02, 2018