🚨 G1 => A05:2021 – Security Misconfiguration [ClickJacking]

⚠️ Base Score: 6.5 MEDIUM Scale: CVSS ⚠️

📌 Description

This repository demonstrates a Clickjacking security flaw present on the G1 website. The vulnerability allows an attacker to load the site inside an iframe, overlaying malicious elements to trick the user.

⚠️ What is Clickjacking?

Clickjacking (also known as UI Redressing) is an attack that tricks the user into interacting with a legitimate page without realizing it. This can be exploited to:

• Steal credentials
• Execute unintended actions
• Trick the user into downloading malware

🔥 How Does the Flaw Work?

The HTML code in this repository loads the G1 website inside a fullscreen iframe and displays a fake popup suggesting an app download.

Risks include:

• The user may be tricked into clicking links or downloading malicious files.
• The site does not implement proper security headers such as X-Frame-Options or Content-Security-Policy.

🛡️ How to Fix?

To mitigate Clickjacking attacks, site administrators should:

1. Add the X-Frame-Options header to prevent loading in iframes:
   root@kitploit:~

   X-Frame-Options: DENY
   

2. Implement Content-Security-Policy (CSP) to restrict iframes:
   root@kitploit:~

   Content-Security-Policy: frame-ancestors 'none';
   

3. Use JavaScript to detect and block unauthorized iframes.

📚 Security References

OWASP Top 10

Clickjacking is a recognized security issue by the OWASP Top 10, one of the leading web application security guides. It falls under category A05:2021 - Vulnerable and Outdated Components, as the absence of iframe protection headers exposes users to attacks.

More information: OWASP Clickjacking

MITRE ATT&CK

In the MITRE ATT&CK framework, Clickjacking is classified under technique T1204 - User Execution, as it exploits user interaction to perform actions without consent.

More information: MITRE ATT&CK - T1204

📢 Disclaimer

This repository is for educational and security research purposes only. Do not use this code for malicious purposes!

Proofs of Concept [PoC]

I wrote the index.html that renders a web page (especiais.g1.globo.com/app-g1/index.html). This page has a high-severity flaw because it lacks X-Frame in its headers, allowing us to render (and steal) an entire original page and host it on our own server or host under our control.

Explore the site here:

[

In the initial section of the compromised rendered page, I inserted a block of code in the head that will trigger a pop-up after a 2-second interval. This pop-up was strategically designed to facilitate Social Engineering techniques. This approach will allow the implementation of a Drive-By Download mechanism, enabling the automatic download of malicious content directly to the user's device. Once the download is complete, the malicious code can be executed, paving the way for the installation of various payloads such as a RAT (Remote Access Trojan), Ransomware, Infostealer, among other cyber threats.

In this proof of concept I added an image to be opened: