Hello, everyone.
So in this video, we are going to see unmitigated website against click tracking.
So we have already seen multiple websites which are vulnerable to click tracking.
Now, in case you come across any website which actually defends click tracking by putting the necessary
protection in place, how you're going to identify that.
So for that, I have put this video in which we are going to identify if the website is not vulnerable
to click Jianqing using multiple ways.
The website is Starbucks start and.
All right, so first we misidentified the website is vulnerable or not, one rebel using the network
tab.
So as you can see, I opened the network tab with the help of Right Click Inspect Element.
And you can come over here now into the network tab.
When you are there, you just need to reload the website again and you will be able to see all the request
and response over here.
Now just click on to the first request.
That is the Starbucks start in which you can see over here and once you click on that.
You will be able to see all the necessary headers that are present into that particular request.
So as you can see over here, there is a header which is present with these x frame options, same origin.
And we have already seen that directives for click checking and extreme options.
So this is one of the directive that fits into the prediction of click tracking and thus we can confirm
this website is not vulnerable to click tracking attack.
All right.
Let's try the other way around, which is through the code that we have made to identify and make posse's
for click tracking.
So I'm just going to put our target over here with your Starbucks card and I'm going to see if the code
so once I have saved the code, I'm going to open it with my browser.
And you can see there would be an error which is refused to connect.
Why is this error coming?
Because the Target website, which is Tarbuck Start End, is not allowed to get opened into an iFrame
because we have seen the prediction that was Extreme Options Directive, which says SIM Origin, and
this is a different origin, which is basically a word localhost machine and it is not allowed to open
that target website into our new iFrame.
All right, let's see another way to identify if the website is not vulnerable as we have already used
Sami dot people to make quick Busey's on the go.
Let's see if we are able to open up at over here or not.
And you can see we will get the same result and it refused to connect.
And the last one which we have seen, which is the security headers, let's try to identify all here
as well.
And you can see once I hit scan, there is a security header which is present that is extreme options
that you can see over here because of which we can confirm that click checking is not present on this
target Web site.
So I hope you guys understood the four ways that we sought to identify if any website is vulnerable
to this attack or not.
Thank you.