Thursday, March 28, 2024

New Attack Called “XSSJacking” Discovered That Combined of Clickjacking, Pastejacking and Self-XSS Attacks

A New Attack method called “XSSJacking” a type of Web application Clickjacking, Pastejacking and Self-XSS Web application based Attack Discovered by the Security Researcher Dylan Ayrey.

While Clickjacking vulnerability existing in particular page, this attack will trigger Self-XSS.

“SelfXSS is a social engineering attack used to gain control of victims’ web accounts.In a selfXSS attack, the victim of the attack accidentally runs malicious code in his/her own web browser, thus exposing it to the attacker

Clickjacking Attack performs when an attacker to trick a user into clicking on a button or link on another page when they were intending to click on the top level page.

Thus, the attacker is “hijacking” clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.

How “XSSJacking” Works

Researcher Explained About the “XSSJacking”,

This attack leverages Pastejacking to force users to paste XSS payloads into text fields framed from other domains.These frames can be redressed, made invisible, and overlayed on top of other UI elements, making the user think they’re interacting with another website.

Pastejacking

We Testing this vulnerability by “Pastejacking Attack” that allow to victim copy the email address instead of typing and past it in the Test forum registration page, you place an “Enter your email” field and a “Retype your email” field.

Try This Demo

Most of the people, “copy-paste it in the second field” unknowingly malicious website has appended malicious code after his copy-paste text and inserted it into his Good Website settings page.

“After the copy, the contents of their clipboard get overwritten with <script>alert(1)</script>

This method can be combined with a phishing attack to entice users into running seemingly innocent commands.

The malicious code will override the innocent code, and the attacker can gain remote code execution on the user’s host if the user pastes the contents into the terminal, researcher Said

XSSJacking attacks, a malicious actor can steal cookies, inbox messages, change profile settings (phone numbers, emails, etc.), to steal profile details, or perform other malicious actions.

“XSSJacking was a way to chain the two issues together in such a way that got unsuspecting logged in users to XSS themselves,” Ayrey said.

Also Read:

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles