ClickJacking-Scanner/clickjacking_script.py at main · RandomUsernames1/ClickJacking-Scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
from urllib.request import urlopen, Request
from sys import argv, exit
import re

__author__ = 'Aberia_Abelia_Iberia (fixed)'

def check(url):
    """Check if given URL is vulnerable to clickjacking"""

    try:
        if not url.startswith("http"):
            url = "http://" + url

        req = Request(url, headers={"User-Agent": "Mozilla/5.0"})
        data = urlopen(req, timeout=10)
        headers = dict(data.getheaders())

        # Clickjacking protection headers
        if "x-frame-options" in headers:
            return False
        if "content-security-policy" in headers:
            if "frame-ancestors" in headers["content-security-policy"]:
                return False

        return True

    except Exception as e:
        print(" [!] Error:", e)
        return False


def safe_filename(url):
    """Convert URL into a filesystem-safe filename"""
    return re.sub(r'[^a-zA-Z0-9_-]', '_', url)


def create_poc(url):
    """Create HTML PoC page"""

    filename = safe_filename(url) + ".html"

    code = f"""<!DOCTYPE html>
<html>
<head>
    <title>Clickjacking PoC</title>
</head>
<body>
    <h2>Clickjacking Test</h2>
    <p>If the page below loads inside the iframe, the site is vulnerable and you're a hacker, just like Mr freaking ROBOT!.</p>
    <iframe src="{url}" width="800" height="600"></iframe>
</body>
</html>
"""

    with open(filename, "w") as f:
        f.write(code)

    print(f" [*] PoC saved as: {filename}")


def main():
    try:
        sites = open(argv[1], 'r').read().splitlines()
    except:
        print("[*] Usage: python3 clickjacking_tester.py <sites.txt>")
        exit(0)

    for site in sites:
        print(f"\n[*] Checking {site}")
        vulnerable = check(site)

        if vulnerable:
            print(" [+] Website is vulnerable to clickjacking!")
            create_poc(site)
        else:
            print(" [-] Website is NOT vulnerable")


if __name__ == '__main__':
    main()