In Review

Planned

In Progress

Completed

Main Roadmap

Hi team,&nbsp;this time i founded this vulnerability in your website&nbsp;Issue:&nbsp;Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.The server didn't return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a &lt;frame&gt; or &lt;iframe&gt;. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.This vulnerability affects Web Server.POCHere are the steps to reproduce the vulnerability<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://1.open">1.open</a> notepad and paste the following code&lt;!DOCTYPE HTML&gt;&lt;html lang="en-US"&gt;&lt;head&gt;&lt;meta charset="UTF-8"&gt;&lt;title&gt;i Frame&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&lt;h3&gt;This is clickjacking vulnerable&lt;/h3&gt;&lt;iframe src=&nbsp; <a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.stakepark.xyz/">https://www.stakepark.xyz/</a>&nbsp;frameborder="200 px" height="5000px" width="500px"&gt;&lt;/iframe&gt;&lt;/body&gt;&lt;/html&gt;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://2.save">2.save</a> it as &lt;anyname&gt;.html eg s.html3.and just simply open that..4. Understanding the Remedial Action for ClickjackingClickjacking can be prevented using a host of client side browser plugins such as• NoScript –&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://noscript.net">http://noscript.net</a>• Web Protection Suite –&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://www.comitari.com/Web_Protection_Suite">http://www.comitari.com/Web_Protection_Suite</a>These plugins are recommended for daily browsing and can also protect users against additional client side attacks, such as XSS (Cross Site Scripting).The above plugins are client side prevention techniques that should be taught to all application users; however, steps must also be taken from the developer’s end.The following techniques can be used to aid in the prevention of clickjacking:4.1. X-Frame-OptionsThe simplest of all the techniques that only requires a simple configuration setting; for example, this can be done within Apache using the following line:&lt;pre lang="JavaScript" line="1"&gt;Header always append X-Frame-Options DENY&lt;/pre&gt;4.2. FrameBusting JavaScriptThis method utilizes JavaScript to “bust” iframes. This is done by checking if the current web page is the top web page (not within a frame) and if the web page is currently not the top page, then it becomes the top page.The following example segment of code can be used to demonstrate this:&lt;pre lang="JavaScript" line="1"&gt;if (top.location.hostname != self.location.hostname){top.location.href = self.location.href;}&lt;/pre&gt;It should be noted that recent techniques have found to be able to bypass this clickjacking prevention technique as seen in the whitepaper by web application security researcher Collin Jackson –&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://www.collinjackson.com/research/xssauditor.pdf">http://www.collinjackson.com/research/xssauditor.pdf</a>.4.3.Unique URL requestSimilar to a CSRF nonce, this can be employed so attackers cannot deliver the attack URL easily.4.4. CAPTCHAsSimilar to the way it prevents attackers from spamming a web form, this can be used as an additional layer of verification on each transaction.4.5. Element RandomizationGenerally it is possible to clickjack due to buttons and links being in a static area of the web page, allowing attackers to place invisible frames over them. A technique to prevent this from occurring is to randomize the links or buttons on load, thus preventing attackers from hard coding static iframes.Proof of concept:&nbsp;image.pngEXPLOIT:&nbsp;the impact is high. This vulnerability can be linked to a multitude of attacks including keylogging and stealing user credentials.An example of an attack on a application could consist of sending out emails to authenticated users of the application. This would require either some amount of inside knowledge to target specific users. Alternatively, mass emails could be sent out in the hope one user logged in to the application responds. The email would contain an “interesting” link which directs the victim to a landing page displaying an advert.&nbsp;On the landing page is a “skip this ad” link that has a transparent iframe located over it (placed by the attacker). When the victim then clicks on the link, they will interact with the attacker’s malicious code.Further examples of clickjacking attacks can be seen occurring in the past on social media sites where victims are enticed into clicking links which spam their contacts as reported by the BBC News –&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://www.bbc.co.uk/news/10224434">http://www.bbc.co.uk/news/10224434</a>.The clickjacking attack:The “clickjacking” attack allows an evil page to click on a “victim site” on behalf of the visitor.Many sites were hacked this way, including Twitter, Facebook, Paypal and other sites. They are all fixed, of course.The idea:The idea is very simple.Here’s how clickjacking was done with Facebook:A visitor is lured to the evil page. It doesn’t matter how.The page has a harmless-looking link on it (like “get rich now” or “click here, very funny”).Over that link the evil page positions a transparent &lt;iframe&gt; with src from&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="http://facebook.com">facebook.com</a>, in such a way that the “Like” button is right above that link. Usually that’s done with z-index.In attempting to click the link, the visitor in fact clicks the button.Here’s how the evil page looks. To make things clear, the &lt;iframe&gt; is half-transparent (in real evil pages it’s fully transparent):&nbsp;The Demo :&nbsp;&lt;!DOCTYPE HTML&gt;&lt;html&gt;&lt;head&gt;&nbsp; &lt;meta charset="utf-8"&gt;&lt;/head&gt;&lt;body&gt;&lt;style&gt;iframe { /* iframe from the victim site */&nbsp; width: 400px;&nbsp; height: 100px;&nbsp; position: absolute;&nbsp; top:0; left:-20px;&nbsp; opacity: 0.5; /* in real opacity:0 */&nbsp; z-index: 1;}&lt;/style&gt;&lt;div&gt;Click to get rich now:&lt;/div&gt;&lt;!-- The url from the victim site --&gt;&lt;iframe src="/clickjacking/facebook.html"&gt;&lt;/iframe&gt;&lt;button&gt;Click here!&lt;/button&gt;&lt;div&gt;...And you're cool (I'm a cool hacker actually)!&lt;/div&gt;&lt;/body&gt;&lt;/html&gt;The above demo attack which i showed you in the above scenario this can done same on your website by making the exploit according to your website as your website is vulnerable to click jacking.&nbsp;&nbsp;Reference :&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.owasp.org/index.php/Testing_for_Clickjacking_(OWASP-CS-004)">https://www.owasp.org/index.php/Testing_for_Clickjacking_(OWASP-CS-004)</a>&nbsp;SOLUTION:&nbsp;<a target="_blank" rel="noopener noreferrer nofollow" class="link" href="https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet">https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet</a>Thanks<img src="https://fb-usercontent.fra1.cdn.digitaloceanspaces.com/0192e268-22aa-72fc-b145-64de18b0ec15.png" data-width="100%" data-align="left"><img src="https://fb-usercontent.fra1.cdn.digitaloceanspaces.com/0192e26f-3af8-7884-bc3b-072408ad2bb3.png" data-width="100%" data-align="left" alt="image.png">Regards,AhmadAhmadmoin700@gmail.com

Vulnerability: Clickjacking

An Anonymous User

(In R&amp;D) Launch a decentralized staking pool for our users, featuring no minimum deposits and our own validators for high rewards/rates and low commission.<img src="https://fb-usercontent.fra1.cdn.digitaloceanspaces.com/1682272706872.png">

StakePark's Staking Pool

StakePark Team

We need more robust error handling with front end error messaging. Specifically useful for info when we have API failures.

Improved error handling

After disconnecting a wallet, it is not fully disconnected (reloading the page you will see the existing connection).

Wallet won't fully disconnect

We are working on correcting some issues with WalletConnect from wallets. These wallets are currently not working, but we are working on a solution. <ul><li>Trust Wallet</li><li>Exodus</li></ul>

WalletConnect Issues

We've finally got WalletConnect v2 support working, fixing support for a wide selection of wallets.We also will have more details on our staking pool service in the near future. 🛹