点击劫持：X-Frame-Options头缺失 in a frame because it set 'X-Frame-Options' to 'deny'

最新推荐文章于 2024-03-29 11:55:31 发布

陕西赢益园林科技有限公司

最新推荐文章于 2024-03-29 11:55:31 发布

阅读量4w

点赞数 7

分类专栏：渗透报告文章标签： X_Frame_Options 点击劫持：X_Frame_Options头缺失点击劫持 deny Options' to 'deny

本文链接：https://blog.csdn.net/u010403700/article/details/82112917

版权

渗透报告专栏收录该内容

1 篇文章 0 订阅

订阅专栏

最近在一个扯蛋的项目中遇到一堆渗透测试的问题。其中有一个“X-Frame-Options漏洞”问题。我抓耳挠腮的一度不知道怎么解决，最后在我的不屑坚持下.......嘻嘻。愿遇到该BUG的人都能处理掉。我们先看看渗透报告中的东西，以失败而告终。

广告:由于我的博文《docker实现离线地图server》怎么写都搜不到，所以请原谅我这样无耻的推广~~:https://blog.csdn.net/u010403700/article/details/90678645

===================================渗透报告中的内容 START====================================

点击劫持：X-Frame-Options头缺失（低）

漏洞情况：

漏洞危害：

点击劫持（ClickJacking）是一种视觉上的欺骗手段。攻击者使用一个透明的、不可见的iframe，覆盖在一个网页上，然后诱使用户在该网页上进行操作，此时用户将在不知情的情况下点击透明的iframe页面。通过调整iframe页面的位置，可以诱使用户恰好点击在iframe页面的一些功能性按钮上。

解决方案(用不了)：

Tomcat配置X-Frame-Options

2种方法：

第1种：将ClickjackFilter.jar添加到lib目录下。

（可在OWASP的网站中找到）

<filter-name>ClickjackFilterDeny</filter-name>

<filter-class>org.owasp.filters.ClickjackFilter</filter-class>

<init-param>

<param-name>mode</param-name>

<param-value>SAMEORIGIN </param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>ClickjackFilterDeny</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

第2种：打开webapps\ROOT\WEB-INF\web.xml添加以下过滤器：

<filter-name>httpHeaderSecurity</filter-name>

<filter-class>

org.apache.catalina.filters.HttpHeaderSecurityFilter

</filter-class>

<antiClickJackingOption>SAMEORIGIN</antiClickJackingEnabled>

</filter>

<filter-mapping>

<filter-name>httpHeaderSecurity</filter-name>

<url-pattern>/*</url-pattern>

<dispatcher>REQUEST</dispatcher>

</filter-mapping>

===================================渗透报告中的内容 END====================================

本来看文档就头疼，尼玛，看完还没处理掉。在心里画了一万个圈圈骂他们。报错

实在没招了。回过头来再看看加粗的那部分，原来就是 apache 的 HttpHeaderSecurityFilter类。经过反编译看了看源码

原来初始化 antiClickJackingOption 的值是XFrameOption.DENY。我们希望的是antiClickJackingOption=XFrameOption.SAME_ORIGIN。于是就重新了一个类，将HttpHeaderSecurityFilter中的代码复制进去。就好了

提示:XFrameOptionn 中有三中，DENY 不允许嵌入IFrame、SAME_ORIGIN 运行显示同源iframe、ALLOW_FROM指定地址的iframe

终极解决方案

1.编写CntenHttpHeaderSecurityFilter类

public class CntenHttpHeaderSecurityFilter extends FilterBase{
   private static final Log log = LogFactory.getLog(CntenHttpHeaderSecurityFilter.class);
   private static final String HSTS_HEADER_NAME = "Strict-Transport-Security";
   private boolean hstsEnabled;
   private int hstsMaxAgeSeconds;
   private boolean hstsIncludeSubDomains;
   private String hstsHeaderValue;
   private static final String ANTI_CLICK_JACKING_HEADER_NAME = "X-Frame-Options";
   private boolean antiClickJackingEnabled;
   private XFrameOption antiClickJackingOption;
   private URI antiClickJackingUri;
   private String antiClickJackingHeaderValue;
   private static final String BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME = "X-Content-Type-Options";
   private static final String BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE = "nosniff";
   private boolean blockContentTypeSniffingEnabled;

   public CntenHttpHeaderSecurityFilter()
   {
   this.hstsEnabled = true;
   this.hstsMaxAgeSeconds = 0;
   this.hstsIncludeSubDomains = false;

this.antiClickJackingEnabled = true;
this.antiClickJackingOption = XFrameOption.ALLOW_FROM;

this.blockContentTypeSniffingEnabled = true;
}

public void init(FilterConfig filterConfig) throws ServletException {
super.init(filterConfig);

   StringBuilder hstsValue = new StringBuilder("max-age=");
   hstsValue.append(this.hstsMaxAgeSeconds);
   if (this.hstsIncludeSubDomains) {
   hstsValue.append(";includeSubDomains");
   }
   this.hstsHeaderValue = hstsValue.toString();

   StringBuilder cjValue = new StringBuilder(this.antiClickJackingOption.headerValue);
   if (this.antiClickJackingOption == XFrameOption.ALLOW_FROM) {
   cjValue.append(':');
   cjValue.append(this.antiClickJackingUri);
   }
   this.antiClickJackingHeaderValue = cjValue.toString();
   }

   public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
   throws IOException, ServletException
   {
   if (response.isCommitted()) {
   throw new ServletException(sm.getString("httpHeaderSecurityFilter.committed"));
   }

   if ((this.hstsEnabled) && (request.isSecure()) && ((response instanceof HttpServletResponse))) {
   ((HttpServletResponse)response).setHeader("Strict-Transport-Security", this.hstsHeaderValue);
   }

   if ((this.antiClickJackingEnabled) && ((response instanceof HttpServletResponse))) {
   ((HttpServletResponse)response).setHeader("X-Frame-Options", this.antiClickJackingHeaderValue);
   }

   if ((this.blockContentTypeSniffingEnabled) && ((response instanceof HttpServletResponse))) {
   ((HttpServletResponse)response).setHeader("X-Content-Type-Options", "nosniff");
   }

chain.doFilter(request, response);
}

   protected Log getLogger()
   {
   return log;
   }

   protected boolean isConfigProblemFatal()
   {
   return true;
   }

   public boolean isHstsEnabled()
   {
   return this.hstsEnabled;
   }

   public void setHstsEnabled(boolean hstsEnabled)
   {
   this.hstsEnabled = hstsEnabled;
   }

   public int getHstsMaxAgeSeconds()
   {
   return this.hstsMaxAgeSeconds;
   }

   public void setHstsMaxAgeSeconds(int hstsMaxAgeSeconds)
   {
   if (hstsMaxAgeSeconds < 0)
   this.hstsMaxAgeSeconds = 0;
   else
   this.hstsMaxAgeSeconds = hstsMaxAgeSeconds;
   }

   public boolean isHstsIncludeSubDomains()
   {
   return this.hstsIncludeSubDomains;
   }

   public void setHstsIncludeSubDomains(boolean hstsIncludeSubDomains)
   {
   this.hstsIncludeSubDomains = hstsIncludeSubDomains;
   }

   public boolean isAntiClickJackingEnabled()
   {
   return this.antiClickJackingEnabled;
   }

   public void setAntiClickJackingEnabled(boolean antiClickJackingEnabled)
   {
   this.antiClickJackingEnabled = antiClickJackingEnabled;
   }

   public String getAntiClickJackingOption()
   {
   return this.antiClickJackingOption.toString();
   }

   public void setAntiClickJackingOption(String antiClickJackingOption)
   {
   for (XFrameOption option : XFrameOption.values()) {
   if (option.getHeaderValue().equalsIgnoreCase(antiClickJackingOption)) {
   this.antiClickJackingOption = option;
   return;
   }
   }
   throw new IllegalArgumentException(sm.getString("httpHeaderSecurityFilter.clickjack.invalid", new Object[] { antiClickJackingOption }));
   }

   public String getAntiClickJackingUri()
   {
   return this.antiClickJackingUri.toString();
   }

   public boolean isBlockContentTypeSniffingEnabled()
   {
   return this.blockContentTypeSniffingEnabled;
   }

   public void setBlockContentTypeSniffingEnabled(boolean blockContentTypeSniffingEnabled)
   {
   this.blockContentTypeSniffingEnabled = blockContentTypeSniffingEnabled;
   }

   public void setAntiClickJackingUri(String antiClickJackingUri)
   {
       URI uri;
   try
   {
   uri = new URI(antiClickJackingUri);
   }
   catch (URISyntaxException e)
   {
   uri = null;
   throw new IllegalArgumentException(e);
   }

   this.antiClickJackingUri = uri;
   }

   private static enum XFrameOption
   {
   DENY("DENY"),
   SAME_ORIGIN("SAMEORIGIN"),
   ALLOW_FROM("ALLOW-FROM");

private final String headerValue;

   private XFrameOption(String headerValue) {
   this.headerValue = headerValue;
   }

   public String getHeaderValue() {
   return this.headerValue;
   }
   }
}

2.在项目中的web.xml文件中添加自定义Filter

<filter>
       <filter-name>httpHeaderSecurity</filter-name>
       <filter-class>
           com.hd.platform.devlActions.CntenHttpHeaderSecurityFilter
       </filter-class>
       <antiClickJackingEnabled>true</antiClickJackingEnabled>
       <antiClickJackingOption>SAMEORIGIN</antiClickJackingOption>
   </filter>
   <filter-mapping>
       <filter-name>httpHeaderSecurity</filter-name>
       <url-pattern>/*</url-pattern>
       <dispatcher>REQUEST</dispatcher>
   </filter-mapping>

至此问题处理完毕。

需要探讨微服务、微服务容器化、微服务编排、arcgis for javascript 的问题。可加qq:914423503

陕西赢益园林科技有限公司

关注

7
点赞
踩
14

收藏

觉得还不错? 一键收藏
5
评论
点击劫持：X-Frame-Options头缺失 in a frame because it set 'X-Frame-Options' to 'deny'

最近在一个扯蛋的项目中遇到一堆渗透测试的问题。其中有一个“X-Frame-Options漏洞”问题。我抓耳挠腮的一度不知道怎么解决，最后在我的不屑坚持下.......嘻嘻。愿遇到该BUG的人都能处理掉。我们先看看渗透报告中的东西，以失败而告终。广告:由于我的博文《docker实现离线地图server》怎么写都搜不到，所以请原谅我这样无耻的推广~~:https://blog.csdn...
复制链接

扫一扫