NDLI: Practical clickjacking with BeEF

Content Provider	IEEE Xplore Digital Library
Author	Lundeen, B. Alves-Foss, J.
Copyright Year	2012
Description	Author affiliation: Center for Secure and Dependable Systems, University of Idaho, USA (Lundeen, B.; Alves-Foss, J.)
Abstract	A lot of effort has been put into researching client-side attacks, including vulnerabilities like cross-site scripting, cross-site request forgery, and more recently, clickjacking. Similar to other client-side attacks, a clickjacking vulnerability can use the browser to exploit weaknesses in cross domain isolation and the same origin policy. It does this by tricking the user to click on something that is actually not what the user perceives they are clicking on. In the most extreme cases, this vulnerability can cause an unsuspecting user to have their account compromised with a single click. Although there are protections available for clickjacking, the web applications implementing these mitigations are far and in between. Additionally, although the possibility for an attacker to frame a page is easy to detect, it is much more difficult to demonstrate or assess the impact of a clickjacking vulnerability than more traditional client-side vectors. Tools do not currently exist to reliably demonstrate clickjacking exploitation, and the rare demonstrations that are done typically use custom JavaScript and HTML for each individual vulnerability. Worse, many times this esoteric code is never made public, leaving everyone to rewrite their own from scratch. BeEF, known as the Browser Exploitation Framework, is a tool designed to help professional penetration testers easily demonstrate the impact of client-side security vulnerabilities. In this paper, we present a plugin module for BeEF which provides a way for penetration testers to easily demonstrate the impact of clickjacking vulnerabilities.
Starting Page	614
Ending Page	619
File Size	702358
Page Count	6
File Format	PDF
ISBN	9781467327084
e-ISBN	9781467327091
DOI	10.1109/THS.2012.6459919
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2012-11-13
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	styling insert Vectors HTML style Browsers Internet Security Facebook formatting Cascading style sheets
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

On Detection and Prevention of Clickjacking Attack for OSNs

Web application for analysis of CSS styling issues and Gurmukhi fonts for Punjabi website

Social networks in higher education: The business administration and informatics' Students

Hippocratic social network

Cascading style sheets: a novel approach towards productive styling with today's standards

Trusted network for Aerial Vehicles

Framework of multimedia forensic system

Evaluating nominal parameters in fault diagnosis

Silicon photonics for optical connectivity: Small footprint with large dimensions

Practical clickjacking with BeEF

Similar Documents

On Detection and Prevention of Clickjacking Attack for OSNs

Web application for analysis of CSS styling issues and Gurmukhi fonts for Punjabi website

Social networks in higher education: The business administration and informatics' Students

Hippocratic social network

Cascading style sheets: a novel approach towards productive styling with today's standards

Trusted network for Aerial Vehicles

Framework of multimedia forensic system

Evaluating nominal parameters in fault diagnosis

Silicon photonics for optical connectivity: Small footprint with large dimensions

Practical clickjacking with BeEF