ClickJacking Example

ClickJacking Example

Clickjacking takes the form of embedded code, or the script that can execute without user’s knowledge, such as clicking on a button (or a link) that appears to perform another function. Clickjacking attack generally allows to perform an action on victim’s website, mostly cyber criminals target on Facebook and Twitter accounts.

Clickjacking, put simply, is when a button, image, video, or some form of embedded content on a website is overlaid by an invisible layer that sits on top of the site underneath it.

ClickJacking-Example
ClickJacking Example

clickjacking facebook

Clickjacking Facebook – Likejacking is type of clickjacking attacks that targets Facebook’s ‘Like’ button. So, suppose the user visits the attacker’s website. The attacker can embed Facebook’s ‘Like’ button on his page and the attacker wants to trick the user to click on the “Like” button, so, how can he do that? First, he can create a decoy button that lures the user to click on it to claim a free iPad.

clickjacking-facebook
clickjacking facebook

Then, he can reposition the ‘Like’ button exactly on top of the decoy button and, finally, he can make the ‘Like’ button completely transparent using CSS, so, when the user tries to click on the decoy button he ends up getting tricked to click on something he didn’t intend to click on

ClickJacking Example

1] Cursor spoofing attack to steal webcam access : In this attack , attacker shows a you a screen where a video is popup with some amazing title with a button known as ” Click to watch “. And suppose the user moves the cursor over to the ‘Click to watch’ link and clicks. How many of you noticed that the real cursor was hidden all the time and now the cursor is on the ‘Allow’ webcam access button

 

ClickJacking-Example-hacking
ClickJacking Example

2] Double-click attack to steal user private data :In the second attack the attacker asks the user to double-click a blue button on the page. When the user clicks on the button the attacker yields the screen real state to the Google auth dialog in the pop-up window, and the second click goes to that dialogue

ClickJacking-Example-hacking-gmail
ClickJacking Example

As a result, the attacker was granted access to the user’s Google account.

3] Whack-a-mole attack to compromise web surfing anonymity : In the third attack the user is asked to play whack-a-mole game. We encouraged users to click on a sequence of buttons as fast as possible. From the beginning the real cursor is hidden and the user is tricked to control a fake cursor. So, after the user has successfully clicked on several buttons, a Facebook ‘Like’ button is repositioned under the user’s real pointer and which users may not notice while clicking.

ClickJacking Example
ClickJacking Example

The attack combines cursors spoofing and fast-paced clicking techniques and was the most effective attack, we found that 98% of users fell for it. So, once the user clicks on the ‘Like’ button the attacker can instantly reveal the user’s identity.

Types of hacker

Types of hacker !!

Several subgroups of the computer underground with different attitudes and aims use different terms to demarcate themselves from each other, or try to exclude some specific group with which they do not agree, they give more emphasis to a spectrum of different categories, such as white hat, grey hat, black hat and script kiddie.

A Cracker or Cracking is to “gain unauthorized access to a computer in order to commit another crime such as destroying information contained in that system”. These subgroups may also be defined by the legal status of their activities. Continue reading “Types of hacker”

How to bye pass Firewall

How to bye pass Firewall

To bye pass the Firewall you must know the firewall identification means full information about Firewall like type , version , and rules of almost every firewall on a Network.

How to bye pass Firewall
How to bye pass Firewall

These are three technique for Firewall Identification

 

  • Port scanning
  • Firewalking
  • Banner grabbing

Port Scanning (How to bye pass Firewall)

Some firewalls have obvious signatures
  • Check Point’s FireWall-1 listens on TCP ports 256, 257, 258, and 259
  • Check Point NG listens on TCP ports 18210, 18211, 18186, 18190, 18191, and 18192 as well
  • Microsoft’s Proxy Server usually listens on TCP ports 1080 and 1745

Here we are providing you , the ways by which you can conceal your Scanning

  • Randomize target ports
  • Randomize target addresses
  • Randomize source ports
  • Distributed source scans
  • Using multiple computers on the Internet, each taking a small portion of the scanning targets
These techniques will fool most IDS systems with default rules.
And here are the Countermeasure of above
  • Block unneeded ICMP packets at your border router
  • Use an Intrusion Detection System, such as Snort
  • IPPL is a Linux daemon that detects port scans (link Ch 901)
  • Cisco routers have ACL rules to block scans

Firewalking (How to bye pass Firewall)

Firewalking is a method to collect information from remote network that are behind firewalls. Firewalk Looks Through a  Firewall

How to bye pass Firewall
How to bye pass Firewall
 In above figure  , Suppose The target is Router3
We want to know which ports Router3 blocks, and which ports it allows through.
Phase 1: Hopcount Ramping
  1. First Firewalk sends out a series of packets towards the destination with TTL=1, 2, 3, …
  2. When the target (Router3) is reached, that determines the TTL for the next phase
  3. In this example, the Target is at TTL=3, so all future packets will use TTL=4

 

Phase 2: Firewalking

  1. TCP or UDP paclets are sent from the scanning host to the Destination
  2. They all have TTL=4

Firwalking Countermesure

  • You can block “ICMP TTL expired” packets at the gateway
  • But this may negatively affect its performance
  • Because legitimate clients connecting will never know what happened to their connection

Banner Grabbing

Banner are messages sent out by network services while connecting to the service.They announce which service is running on System

Banner grabbing is simple method of OS detection, its also help to find services runs by Firewall. there are three measure services send out through it is TELNET , FTP and Web Server.

Banner Grabbing Countermeasures

  • Eliminate the open port on your firewall
– A management port should not be open externally anyway
  • If you must leave the ports open on the external interface of your firewall
–Change the banner to display a legal warning reminding the offender that all attempts to connect will be logged

How to bye pass Firewall

Breaching  Firewall

Byepassing a firewall using HTTP Tunnel

Placing Backdoors through Firewall

Hiding behind a Covert channel : Loki

The above topic and tools to bye pass firewall cover in next post as How to bye pass Firewall 2