{"id":476253,"date":"2023-08-09T07:26:52","date_gmt":"2023-08-09T07:26:52","guid":{"rendered":""},"modified":"2023-09-05T11:12:19","modified_gmt":"2023-09-05T11:12:19","slug":"clickjacking","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/clickjacking\/","title":{"rendered":"\u70b9\u51fb\u52ab\u6301"},"content":{"rendered":"

\u70b9\u51fb\u52ab\u6301\u901a\u5e38\u79f0\u4e3a\u201cUI \u7ea0\u6b63\u653b\u51fb\u201d\uff0c\u662f\u4e00\u79cd\u7f51\u7edc\u5b89\u5168\u653b\u51fb\uff0c\u901a\u8fc7\u5728\u770b\u4f3c\u65e0\u5bb3\u7684 Web \u5185\u5bb9\u4e0a\u53e0\u52a0\u4e0d\u53ef\u89c1\u5c42\u6765\u64cd\u7eb5\u7528\u6237\u70b9\u51fb\u9690\u85cf\u94fe\u63a5\u3002<\/p>\n

\u70b9\u51fb\u52ab\u6301\u7684\u8d77\u6e90\u53ca\u5176\u9996\u6b21\u51fa\u73b0<\/h2>\n

\u201c\u70b9\u51fb\u52ab\u6301\u201d\u4e00\u8bcd\u6700\u521d\u7531 Jeremiah Grossman \u548c Robert Hansen \u4e8e 2008 \u5e74\u521b\u9020\u3002\u5b83\u4f5c\u4e3a\u4e00\u79cd\u65b0\u9896\u7684\u653b\u51fb\u5a92\u4ecb\u51fa\u73b0\uff0c\u5229\u7528\u4e86\u7528\u6237\u5bf9\u53ef\u89c6 Web \u754c\u9762\u7684\u56fa\u6709\u4fe1\u4efb\u3002\u7b2c\u4e00\u8d77\u5907\u53d7\u77a9\u76ee\u7684\u70b9\u51fb\u52ab\u6301\u4e8b\u4ef6\u53d1\u751f\u5728 2008 \u5e74\uff0c\u5f53\u65f6 Adobe \u7684 Flash \u63d2\u4ef6\u6210\u4e3a\u653b\u51fb\u76ee\u6807\uff0c\u5f15\u8d77\u4e86\u5168\u7403\u5bf9\u8fd9\u4e00\u65b0\u7f51\u7edc\u5b89\u5168\u5a01\u80c1\u7684\u5173\u6ce8\u3002<\/p>\n

\u63ed\u9732\u70b9\u51fb\u52ab\u6301\uff1a\u5a01\u80c1\u5256\u6790<\/h2>\n

\u70b9\u51fb\u52ab\u6301\u662f\u4e00\u79cd\u6b3a\u9a97\u6027\u6280\u672f\uff0c\u653b\u51fb\u8005\u6b3a\u9a97\u7528\u6237\u70b9\u51fb\u7f51\u9875\u7684\u7279\u5b9a\u5143\u7d20\uff0c\u5e76\u76f8\u4fe1\u5b83\u662f\u5176\u4ed6\u5143\u7d20\u3002\u8fd9\u662f\u901a\u8fc7\u5728\u7f51\u9875\u5143\u7d20\u4e0a\u53e0\u52a0\u900f\u660e\u6216\u4e0d\u900f\u660e\u5c42\u6765\u5b9e\u73b0\u7684\u3002\u4f8b\u5982\uff0c\u7528\u6237\u53ef\u80fd\u8ba4\u4e3a\u4ed6\u4eec\u6b63\u5728\u5355\u51fb\u5e38\u89c4\u6309\u94ae\u6216\u94fe\u63a5\uff0c\u4f46\u5b9e\u9645\u4e0a\uff0c\u4ed6\u4eec\u6b63\u5728\u4e0e\u9690\u85cf\u7684\u6076\u610f\u5185\u5bb9\u8fdb\u884c\u4ea4\u4e92\u3002<\/p>\n

\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u8be5\u65b9\u6cd5\u8bf1\u9a97\u7528\u6237\u6267\u884c\u4ed6\u4eec\u901a\u5e38\u4e0d\u4f1a\u540c\u610f\u7684\u64cd\u4f5c\uff0c\u4f8b\u5982\u4e0b\u8f7d\u6076\u610f\u8f6f\u4ef6\u3001\u65e0\u610f\u4e2d\u5171\u4eab\u79c1\u4eba\u4fe1\u606f\uff0c\u751a\u81f3\u53d1\u8d77\u91d1\u878d\u4ea4\u6613\u3002<\/p>\n

\u89e3\u5bc6\u70b9\u51fb\u52ab\u6301\u7684\u673a\u5236<\/h2>\n

\u70b9\u51fb\u52ab\u6301\u653b\u51fb\u6d89\u53ca\u4e09\u4e2a\u4e3b\u8981\u7ec4\u6210\u90e8\u5206\uff1a<\/p>\n

    \n
  1. \u53d7\u5bb3\u8005<\/strong>\uff1a\u4e0e\u6076\u610f\u7f51\u7ad9\u4ea4\u4e92\u7684\u7528\u6237\u3002<\/li>\n
  2. \u653b\u51fb\u8005<\/strong>\uff1a\u521b\u5efa\u548c\u63a7\u5236\u6076\u610f\u7f51\u7ad9\u7684\u5b9e\u4f53\u3002<\/li>\n
  3. \u754c\u9762<\/strong>\uff1a\u542b\u6709\u6076\u610f\u94fe\u63a5\u7684\u6b3a\u9a97\u6027\u7f51\u9875\u3002<\/li>\n<\/ol>\n

    \u653b\u51fb\u8005\u8bbe\u8ba1\u4e00\u4e2a\u5305\u542b\u53e6\u4e00\u4e2a\u7ad9\u70b9\uff08\u76ee\u6807\uff09\u7684 iframe \u7684\u7f51\u9875\uff0c\u5e76\u4f7f\u8be5 iframe \u900f\u660e\u3002\u8986\u76d6\u5728\u4e0d\u53ef\u89c1 iframe \u4e0a\u7684\u662f\u7528\u6237\u53ef\u80fd\u4e0e\u4e4b\u4ea4\u4e92\u7684\u5143\u7d20\uff0c\u4f8b\u5982\u6d41\u884c\u64cd\u4f5c\u7684\u6309\u94ae\u6216\u5f15\u4eba\u6ce8\u76ee\u7684\u94fe\u63a5\u3002\u5f53\u7528\u6237\u8bbf\u95ee\u653b\u51fb\u8005\u7684\u7ad9\u70b9\u5e76\u5355\u51fb\u4ed6\u4eec\u8ba4\u4e3a\u5b89\u5168\u7684\u5185\u5bb9\u65f6\uff0c\u4ed6\u4eec\u4f1a\u5728\u4e0d\u77e5\u4e0d\u89c9\u4e2d\u4e0e\u9690\u85cf\u7684 iframe \u8fdb\u884c\u4ea4\u4e92\uff0c\u4ece\u800c\u5728\u76ee\u6807\u7ad9\u70b9\u4e0a\u6267\u884c\u64cd\u4f5c\u3002<\/p>\n

    \u70b9\u51fb\u52ab\u6301\u653b\u51fb\u7684\u4e3b\u8981\u7279\u5f81<\/h2>\n
      \n
    1. \u9690\u5f62<\/strong>\uff1a\u6076\u610f\u94fe\u63a5\u9690\u85cf\u5728\u770b\u4f3c\u771f\u5b9e\u7684\u7f51\u9875\u5185\u5bb9\u4e4b\u4e0b\uff0c\u901a\u5e38\u5bf9\u7528\u6237\u6765\u8bf4\u662f\u4e0d\u53ef\u89c1\u7684\u3002<\/li>\n
    2. \u6b3a\u9a97<\/strong>\uff1a\u70b9\u51fb\u52ab\u6301\u901a\u8fc7\u8bef\u5bfc\u7528\u6237\u800c\u7316\u7357\uff0c\u8ba9\u7528\u6237\u76f8\u4fe1\u81ea\u5df1\u5728\u6267\u884c\u4e00\u9879\u64cd\u4f5c\uff0c\u800c\u5b9e\u9645\u4e0a\u5374\u5728\u6267\u884c\u53e6\u4e00\u9879\u64cd\u4f5c\u3002<\/li>\n
    3. \u975e\u81ea\u613f\u884c\u4e3a<\/strong>\uff1a\u8fd9\u4e9b\u653b\u51fb\u8bf1\u9a97\u7528\u6237\u5728\u4ed6\u4eec\u4e0d\u77e5\u60c5\u6216\u672a\u7ecf\u540c\u610f\u7684\u60c5\u51b5\u4e0b\u6267\u884c\u64cd\u4f5c\u3002<\/li>\n
    4. \u591a\u529f\u80fd\u6027<\/strong>\uff1a\u70b9\u51fb\u52ab\u6301\u53ef\u7528\u4e8e\u591a\u79cd\u6709\u5bb3\u6d3b\u52a8\uff0c\u4ece\u4f20\u64ad\u6076\u610f\u8f6f\u4ef6\u5230\u7a83\u53d6\u4e2a\u4eba\u4fe1\u606f\u3002<\/li>\n<\/ol>\n

      \u70b9\u51fb\u52ab\u6301\u653b\u51fb\u7684\u7c7b\u578b<\/h2>\n

      \u70b9\u51fb\u52ab\u6301\u653b\u51fb\u53ef\u4ee5\u6839\u636e\u5176\u6267\u884c\u65b9\u5f0f\u548c\u9884\u671f\u5371\u5bb3\u8fdb\u884c\u5206\u7c7b\u3002\u4ee5\u4e0b\u662f\u4e09\u79cd\u4e3b\u8981\u7c7b\u578b\uff1a<\/p>\n\n\n\n\n\n\n\n
      \u7c7b\u578b<\/th>\n\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n
      \u5149\u6807\u52ab\u6301<\/td>\n\u4fee\u6539\u5149\u6807\u7684\u5916\u89c2\u548c\u4f4d\u7f6e\uff0c\u8bf1\u9a97\u7528\u6237\u5355\u51fb\u610f\u5916\u533a\u57df\u3002<\/td>\n<\/tr>\n
      \u70b9\u8d5e\u52ab\u6301<\/td>\n\u8bf1\u9a97\u7528\u6237\u5728\u4e0d\u77e5\u60c5\u7684\u60c5\u51b5\u4e0b\u559c\u6b22\u793e\u4ea4\u5a92\u4f53\u5e16\u5b50\uff0c\u901a\u5e38\u662f\u4e3a\u4e86\u4f20\u64ad\u9a97\u5c40\u6216\u589e\u52a0\u77e5\u540d\u5ea6\u3002<\/td>\n<\/tr>\n
      \u6587\u4ef6\u52ab\u6301<\/td>\n\u4ee5\u65e0\u5bb3\u7684\u4e0b\u8f7d\u94fe\u63a5\u6216\u6309\u94ae\u4e3a\u5e4c\u5b50\uff0c\u8bf1\u4f7f\u7528\u6237\u4e0b\u8f7d\u6216\u8fd0\u884c\u6076\u610f\u6587\u4ef6\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

      \u70b9\u51fb\u52ab\u6301\u7684\u5229\u7528\u53ca\u76f8\u5173\u95ee\u9898\u7684\u89e3\u51b3\u65b9\u6848<\/h2>\n

      \u70b9\u51fb\u52ab\u6301\u653b\u51fb\u53ef\u80fd\u4f1a\u5bfc\u81f4\u5404\u79cd\u95ee\u9898\uff0c\u4ece\u8f7b\u5fae\u7684\u70e6\u607c\u5230\u91cd\u5927\u7684\u5b89\u5168\u6f0f\u6d1e\u3002\u4ed6\u4eec\u53ef\u4ee5\u4f20\u64ad\u6076\u610f\u8f6f\u4ef6\u3001\u7a83\u53d6\u654f\u611f\u6570\u636e\u3001\u64cd\u7eb5\u7528\u6237\u64cd\u4f5c\u7b49\u7b49\u3002<\/p>\n

      \u5e78\u8fd0\u7684\u662f\uff0c\u6709\u591a\u79cd\u89e3\u51b3\u65b9\u6848\u53ef\u4ee5\u5bf9\u6297\u70b9\u51fb\u52ab\u6301\uff1a<\/p>\n

        \n
      1. \u4f7f\u7528 X-Frame-Options \u6807\u5934<\/strong>\uff1a\u6307\u793a\u6d4f\u89c8\u5668\u662f\u5426\u53ef\u4ee5\u5bf9\u7ad9\u70b9\u8fdb\u884c\u52a0\u6846\u3002\u901a\u8fc7\u62d2\u7edd\u6846\u67b6\uff0c\u60a8\u53ef\u4ee5\u6709\u6548\u9632\u6b62\u70b9\u51fb\u52ab\u6301\u3002<\/li>\n
      2. \u5e27\u7834\u574f\u811a\u672c<\/strong>\uff1a\u8fd9\u4e9b\u811a\u672c\u963b\u6b62\u7f51\u7ad9\u5728\u6846\u67b6\u5185\u663e\u793a\u3002<\/li>\n
      3. \u5185\u5bb9\u5b89\u5168\u7b56\u7565 (CSP)<\/strong>\uff1a\u73b0\u4ee3\u6d4f\u89c8\u5668\u652f\u6301\u6b64\u7b56\u7565\uff0c\u8fd9\u4f1a\u963b\u6b62\u5728\u6846\u67b6\u4e2d\u52a0\u8f7d\u9875\u9762\u3002<\/li>\n<\/ol>\n

        \u4e0e\u7c7b\u4f3c\u7f51\u7edc\u5b89\u5168\u5a01\u80c1\u7684\u6bd4\u8f83<\/h2>\n\n\n\n\n\n\n
        \u5b66\u671f<\/th>\n\u63cf\u8ff0<\/th>\n\u76f8\u4f3c\u4e4b\u5904<\/th>\n\u5dee\u5f02<\/th>\n<\/tr>\n<\/thead>\n
        \u7f51\u7edc\u9493\u9c7c<\/td>\n\u653b\u51fb\u8005\u5192\u5145\u53ef\u4fe1\u5b9e\u4f53\u6765\u8bf1\u9a97\u7528\u6237\u6cc4\u9732\u654f\u611f\u4fe1\u606f\u3002<\/td>\n\u4e24\u8005\u90fd\u6d89\u53ca\u6b3a\u9a97\u548c\u64cd\u7eb5\u7528\u6237\u4fe1\u4efb\u3002<\/td>\n\u7f51\u7edc\u9493\u9c7c\u901a\u5e38\u4f7f\u7528\u7535\u5b50\u90ae\u4ef6\u5e76\u6a21\u4eff\u53d7\u4fe1\u4efb\u5b9e\u4f53\u7684\u89c6\u89c9\u98ce\u683c\uff0c\u800c\u70b9\u51fb\u52ab\u6301\u5219\u4f7f\u7528\u6076\u610f\u7f51\u7edc\u5185\u5bb9\u3002<\/td>\n<\/tr>\n
        \u8de8\u7ad9\u811a\u672c (XSS)<\/td>\n\u6076\u610f\u811a\u672c\u88ab\u6ce8\u5165\u53d7\u4fe1\u4efb\u7684\u7f51\u7ad9\u3002<\/td>\n\u4e24\u8005\u90fd\u53ef\u80fd\u5bfc\u81f4\u4ee3\u8868\u7528\u6237\u8fdb\u884c\u672a\u7ecf\u6388\u6743\u7684\u64cd\u4f5c\u3002<\/td>\nXSS \u6d89\u53ca\u5c06\u4ee3\u7801\u6ce8\u5165\u7f51\u7ad9\uff0c\u800c\u70b9\u51fb\u52ab\u6301\u5219\u6b3a\u9a97\u7528\u6237\u4e0e\u8986\u76d6\u7684\u5185\u5bb9\u8fdb\u884c\u4ea4\u4e92\u3002<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        \u5bf9\u6297\u70b9\u51fb\u52ab\u6301\u7684\u672a\u6765\u524d\u666f\u548c\u6280\u672f<\/h2>\n

        \u5c55\u671b\u672a\u6765\uff0c\u5f00\u53d1\u4eba\u5458\u548c\u5b89\u5168\u4e13\u4e1a\u4eba\u5458\u9700\u8981\u7ed3\u5408\u5b89\u5168\u5b9e\u8df5\u6765\u9632\u6b62\u70b9\u51fb\u52ab\u6301\u653b\u51fb\u3002\u589e\u5f3a\u6d4f\u89c8\u5668\u5b89\u5168\u6027\u3001\u66f4\u590d\u6742\u7684\u6846\u67b6\u7834\u574f\u811a\u672c\u4ee5\u53ca\u66f4\u5e7f\u6cdb\u5730\u91c7\u7528\u5185\u5bb9\u5b89\u5168\u7b56\u7565\u662f\u6253\u51fb\u70b9\u51fb\u52ab\u6301\u7684\u672a\u6765\u524d\u666f\u3002<\/p>\n

        \u6b64\u5916\uff0c\u4eba\u5de5\u667a\u80fd\u548c\u673a\u5668\u5b66\u4e60\u6280\u672f\u53ef\u4ee5\u901a\u8fc7\u8bc6\u522b\u7528\u6237\u4ea4\u4e92\u548c\u7f51\u7ad9\u7ed3\u6784\u4e2d\u7684\u6a21\u5f0f\u548c\u5f02\u5e38\u6765\u68c0\u6d4b\u548c\u9632\u6b62\u70b9\u51fb\u52ab\u6301\u3002<\/p>\n

        \u4ee3\u7406\u670d\u52a1\u5668\u53ca\u5176\u4e0e\u70b9\u51fb\u52ab\u6301\u7684\u8fde\u63a5<\/h2>\n

        \u4ee3\u7406\u670d\u52a1\u5668\u5145\u5f53\u7528\u6237\u548c\u4e92\u8054\u7f51\u4e4b\u95f4\u7684\u4e2d\u4ecb\u3002\u867d\u7136\u5b83\u4eec\u4e0d\u80fd\u76f4\u63a5\u9632\u6b62\u70b9\u51fb\u52ab\u6301\uff0c\u4f46\u53ef\u4ee5\u901a\u8fc7\u5c4f\u853d\u7528\u6237\u7684 IP \u5730\u5740\u6765\u6dfb\u52a0\u989d\u5916\u7684\u5b89\u5168\u5c42\uff0c\u4f7f\u653b\u51fb\u8005\u66f4\u96be\u7784\u51c6\u7279\u5b9a\u7528\u6237\u3002\u6b64\u5916\uff0c\u4e00\u4e9b\u9ad8\u7ea7\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u63d0\u4f9b\u5a01\u80c1\u60c5\u62a5\u5e76\u68c0\u6d4b\u53ef\u7591\u6d3b\u52a8\uff0c\u4ece\u800c\u53ef\u80fd\u8bc6\u522b\u5e76\u963b\u6b62\u70b9\u51fb\u52ab\u6301\u5c1d\u8bd5\u3002<\/p>\n

        \u76f8\u5173\u94fe\u63a5<\/h2>\n
          \n
        1. OWASP \u70b9\u51fb\u52ab\u6301\u9632\u5fa1\u5907\u5fd8\u5355<\/a><\/li>\n
        2. \u7f51\u7edc\u5b89\u5168\uff1a\u70b9\u51fb\u52ab\u6301<\/a><\/li>\n
        3. \u4f7f\u7528 X-Frame-Options \u9632\u6b62\u70b9\u51fb\u52ab\u6301\u653b\u51fb<\/a><\/li>\n
        4. \u70b9\u51fb\u52ab\u6301\u7684\u8fc7\u53bb\u3001\u73b0\u5728\u548c\u672a\u6765<\/a><\/li>\n<\/ol>","protected":false},"featured_media":467870,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-476253","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about Clickjacking: A Deep Dive into The Cyber Threat Landscape<\/mark>","faq_items":[{"question":"What is Clickjacking?","answer":"

          Clickjacking, also known as a \"UI Redress Attack,\" is a cybersecurity attack that tricks users into clicking on concealed links by overlaying invisible layers over seemingly harmless web content.<\/p>"},{"question":"When was the term \"Clickjacking\" first coined and by whom?","answer":"

          The term \"Clickjacking\" was first introduced by Jeremiah Grossman and Robert Hansen in 2008.<\/p>"},{"question":"How does Clickjacking work?","answer":"

          In a clickjacking attack, a deceptive webpage is created containing an invisible iframe of another site (the target). Over this invisible iframe, there are elements that the user is likely to interact with, like buttons for popular actions or compelling links. When the user interacts with these elements, they're unknowingly interacting with the hidden iframe, leading to unintentional actions on the target site.<\/p>"},{"question":"What are the key features of Clickjacking attacks?","answer":"

          The key features of Clickjacking attacks include invisibility (the malicious links are hidden under genuine-looking web content), deception (users are misled into believing they're performing one action when they're doing another), non-consensual actions (users are tricked into performing actions without their knowledge or consent), and versatility (clickjacking can be used for a wide array of harmful activities).<\/p>"},{"question":"What are the different types of Clickjacking attacks?","answer":"

          Clickjacking attacks can be categorized into three main types: Cursorjacking (modifies the appearance and location of the cursor, tricking the user into clicking unexpected areas), Likejacking (tricks the user into unknowingly liking a social media post), and Filejacking (traps the user into downloading or running a malicious file).<\/p>"},{"question":"How can Clickjacking attacks be prevented?","answer":"

          Clickjacking attacks can be combated by using the X-Frame-Options Header (instructs the browser whether the site can be framed), Framebusting Scripts (prevent a website from being displayed inside a frame), and Content Security Policy (CSP) that modern browsers support, which prevents loading a page in a frame.<\/p>"},{"question":"How are Clickjacking attacks different from Phishing and Cross-Site Scripting (XSS)?","answer":"

          While Clickjacking, Phishing, and XSS all involve deception and user manipulation, they differ in their execution. Phishing often uses email and mimics the visual style of trusted entities, while Clickjacking uses malicious web content. On the other hand, XSS involves the injection of code into a website, while Clickjacking tricks the user into interacting with overlaid content.<\/p>"},{"question":"How are proxy servers associated with Clickjacking?","answer":"

          While proxy servers don't directly prevent Clickjacking, they can add an extra layer of security by masking the user's IP address, making it more difficult for attackers to target specific users. Some advanced proxy servers can even provide threat intelligence and detect suspicious activities, potentially identifying and blocking Clickjacking attempts.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/476253","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/476253\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/467870"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=476253"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}