X-Frame-Options: All about Clickjacking?

[Nytro]

X-Frame-Options: All about Clickjacking?

“How else do X-Frame-Options protect my website”

A poem by Frederik Braun (Mozilla) and Mario Heiderich (Cure53)

The X-Frame-Options header is known to be a good measurement against those so

called Clickjacking attacks. You know, this kind of attack where some other website

loads important parts of your website inside an Iframe or even frameset, makes

everything invisible and overlays attractive looking links and buttons with your invisible

website. But - is it really all about Clickjacking? Let us find out about that!

I. Introduction

II. The Docmode - Problem

III. Drag ’ N ’ Drop XSS

IV. Copy & Paste XSS

V. Invisible Site - Wide XSS

VI. Cross - Site Scripting & Length Restrictions

VII. JavaScript à la Carte

VIII. Frame Busting

IX. Side Channels & Cross - Origin Leaks

X. Bye bye , CSP

XI. Conclusion

Download:

https://frederik-braun.com/xfo-clickjacking.pdf