Paper Info
Title
Clickjuggler: Checking for incomplete defenses against clickjacking
Abstract
Clickjacking is a new attack which exploits a vulnerability in web applications. It tricks victims into clicking on something different from what they perceive they are clicking on. The victims may reveal confidential information or start unintended online transactions. Clickjacking can be prevented if appropriate countermeasures such as frame busting are implemented in web applications. However, the correct implementation is not easy. A trivial mistake in the implementation leads to evasion of the countermeasures. For the correct implementation, web developers must have intimate knowledge on evasion techniques of the countermeasures. In this paper, we propose Clickjuggler, an automated tool for checking for defenses against clickjacking during the development. Clickjuggler generates clickjacking attacks, performs those attacks on web applications, and checks whether the attacks are successful or not. By automating the process of checking for the clickjacking vulnerabilities, web developers are released from the burden of checking the correctness of their implementation. Unskillful developers can benefit from Clickjuggler since no special knowledge on clickjacking is needed to use Clickjuggler. Our experimental results demonstrate that Clickjuggler can check for the clickjacking vulnerabilities in 4 real-world web applications.
Year
DOI
Venue
2014
10.1109/PST.2014.6890943
Privacy, Security and Trust
Keywords
Field
DocType
Internet,security of data,Clickjuggler tool,Web applications,clickjacking attack,clickjacking vulnerabilities,evasion techniques,frame busting countermeasure
Clickjacking,Internet privacy,World Wide Web,Mistake,Confidentiality,Computer science,Computer security,Correctness,Exploit,Web application,Vulnerability,Content Security Policy
Conference
ISSN
Citations 
PageRank 
1712-364X
1
0.39
References 
Authors
6
2
Name
Order
Citations
PageRank
Yusuke Takamatsu141.77
kenji kono21488.43