[INVALID] Issues with ClearClick in Version 1.9.9.63

Ask for help about NoScript, no registration needed to post
ClearClick missing something?

[INVALID] Issues with ClearClick in Version 1.9.9.63

Post by ClearClick missing something? »

I justed checked a demo on ClickJacking: http://ha.ckers.org/weird/followmouse.html
And sadly the default ClickJacking prevention mechanism in IE catches it and NoScript doesn't alert me or prevents it?

I have ClearClick enabled on trusted and untrusted sites.
Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
User avatar
Giorgio Maone
Site Admin
Posts: 9524
Joined: Wed Mar 18, 2009 11:22 pm
Location: Palermo - Italy
Contact:

Re: Issues with ClearClick in Version 1.9.9.63

Post by Giorgio Maone »

Nope, ClearClick is working just fine.
That demo is implemented wrongly, since it doesn't account for a real world scenario (i.e. the parent "attacker" document being on a different domain than the embedded "victim" iframe).
Please check http://raffon.net/research/cj/cj.html or another cross-site "real world" PoC, instead.
Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3
Post Reply