{"id":141439,"date":"2025-08-24T11:11:56","date_gmt":"2025-08-24T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","title":{"rendered":"Sulm ndaj shtesave t\u00eb shfletuesve me menaxher\u00eb fjal\u00ebkalimesh, i cili p\u00ebrdor klikuarjen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb konferenc\u00ebn DEF CON 33 u prezantua nj\u00eb metod\u00eb sulmi ndaj shtesave t\u00eb shfletuesit q\u00eb fusin elemente t\u00eb tyre t\u00eb nd\u00ebrfaqes n\u00eb faqen e shikuar. P\u00ebrdorimi i k\u00ebtij sulmi ndaj shtesave me menaxher\u00eb fjal\u00ebkalimesh mund t\u00eb \u00e7oj\u00eb n\u00eb rrjedhjen e informacionit t\u00eb ruajtur n\u00eb menaxher\u00ebt e fjal\u00ebkalimeve, si\u00e7 jan\u00eb parametrat e autentifikimit, informacionet p\u00ebr kartat e kreditit, t\u00eb dh\u00ebnat personale dhe fjal\u00ebkalimet nj\u00eb her\u00ebsh p\u00ebr verifikimin me dy faktor\u00eb. Problemi prek t\u00eb gjith\u00eb menaxher\u00ebt e fjal\u00ebkalimeve t\u00eb testuar, p\u00ebrfshir\u00eb 1Password, Bitwarden, LastPass, KeePassXC-Browser, NordPass, ProtonPass dhe Keeper. <\/p>\n
Metoda e sulmit bazohet n\u00eb faktin se shtesat e shfletuesit fusin nj\u00eb dialog p\u00ebr k\u00ebrkes\u00ebn e autopopullimit t\u00eb fjal\u00ebkalimit drejtp\u00ebrdrejt n\u00eb faqen e shfaqur, duke integruar elementet e tyre n\u00eb DOM (Modeli i Objekteve t\u00eb Dokumentit) t\u00eb asaj faqeje. N\u00ebse sulmuesi ka mund\u00ebsi t\u00eb ekzekutoj\u00eb kodin e tij JavaScript n\u00eb faqe, p\u00ebr shembull, duke shfryt\u00ebzuar nj\u00eb dob\u00ebsi XSS n\u00eb faqen e internetit, ai mund t\u00eb manipuloj\u00eb t\u00eb gjith\u00eb elementet n\u00eb DOM, p\u00ebrfshir\u00eb ato t\u00eb shtesave t\u00eb shfletuesit. <\/p>\n
P\u00ebrve\u00e7 t\u00eb tjerash, ka mund\u00ebsi t\u00eb b\u00ebhet dialogu i konfirmimit transparent dhe t\u00eb p\u00ebrputhen hap\u00ebsir\u00ebn e butonit n\u00eb k\u00ebt\u00eb dialog me butonin e dialogut t\u00eb rrem\u00eb, t\u00eb krijuar nga sulmuesi dhe q\u00eb nxit p\u00ebrdoruesin t\u00eb klikoj\u00eb. Si dialog\u00eb t\u00eb till\u00eb t\u00eb rrem\u00eb mund t\u00eb p\u00ebrdoren k\u00ebrkesa fiktive p\u00ebr autorizim t\u00eb pun\u00ebs me Cookie, reklamat ose format me CAPTCHA. Duke vendosur dialogun e rrem\u00eb n\u00ebn dialogun transparent t\u00eb menaxherit t\u00eb fjal\u00ebkalimeve dhe duke p\u00ebrputhur vendndodhjen e butonave n\u00eb ekran, \u00ebsht\u00eb e mundur q\u00eb klikimi i p\u00ebrdoruesit t\u00eb shkoj\u00eb n\u00eb butonin e konfirmimit t\u00eb plot\u00ebsimit t\u00eb parametrave t\u00eb autentifikimit n\u00eb dialogun e menaxherit t\u00eb fjal\u00ebkalimeve, ndon\u00ebse p\u00ebrdoruesi do t\u00eb mendoj\u00eb se ai klikoi, p\u00ebr shembull, butonin e mbylljes s\u00eb dritares s\u00eb reklam\u00ebs.
<\/center> <\/p>\n
Sulmi p\u00ebrb\u00ebhet nga hapat e m\u00ebposht\u00ebm: <\/p>\n
\n
Krijimi i nj\u00eb elementi t\u00eb ngacmuar n\u00eb faqe, q\u00eb nxit veprimin e klikimit.\n
Shtimi i nj\u00eb webshtese p\u00ebr hyrje ose p\u00ebrmbushjen e t\u00eb dh\u00ebnave personale n\u00eb faqe.\n
Vendosja e transparenc\u00ebs p\u00ebr formularin web («opacity: 0.001» n\u00eb CSS).\n
P\u00ebrdorimi i metod\u00ebs focus() p\u00ebr t\u00eb vendosur fokusin n\u00eb fush\u00ebn e hyrjes n\u00eb form\u00eb, q\u00eb \u00e7on n\u00eb aktivizimin e dialogut t\u00eb autopopullimit t\u00eb menaxherit t\u00eb fjal\u00ebkalimeve.\n
K\u00ebrkimi i dialogut q\u00eb shfaqet t\u00eb menaxherit t\u00eb fjal\u00ebkalimeve n\u00eb DOM dhe vendosja e transparenc\u00ebs p\u00ebr t\u00eb.\n
Pritja e klikimit t\u00eb p\u00ebrdoruesit n\u00eb elementin e duksh\u00ebm t\u00eb ngacmimit n\u00eb faqe, q\u00eb me p\u00ebrputhjen e duhur t\u00eb elementeve t\u00eb dukshme dhe t\u00eb padukshme do t\u00eb \u00e7oj\u00eb n\u00eb klikimin mbi butonin n\u00eb dialogun transparent dhe plot\u00ebsimin e fushave nga menaxheri i fjal\u00ebkalimeve.\n
Ekstraktimi i t\u00eb dh\u00ebnave nga forma e plot\u00ebsuar dhe d\u00ebrgimi i tyre n\u00eb serverin e sulmuesit. <\/ul>\n
P\u00ebr shkak se autopopullimi i parametrave t\u00eb autentifikimit n\u00eb menaxherin e fjal\u00ebkalimeve aktivizohet vet\u00ebm p\u00ebr faqet ku k\u00ebta parametra jan\u00eb ruajtur, p\u00ebr organizimin e sulmit \u00ebsht\u00eb e nevojshme t\u00eb ket\u00eb mund\u00ebsi p\u00ebr t\u00eb ekzekutuar kodin e tij JavaScript n\u00eb faqen e synuar ose n\u00eb nj\u00eb n\u00ebn domen. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, p\u00ebr sulmin \u00ebsht\u00eb e nevojshme ose t\u00eb fitosh nj\u00eb n\u00ebn domain n\u00eb t\u00eb nj\u00ebjtin domen si faqja e synuar, ose t\u00eb gjesh nj\u00eb dob\u00ebsi XSS n\u00eb faqen e internetit q\u00eb lejon injektimin e kodit t\u00eb tij n\u00eb p\u00ebrmbajtjen e shfaqur p\u00ebrdoruesit. <\/p>\n
V\u00ebrehet se shum\u00eb p\u00ebrdorues p\u00ebrdorin nj\u00eb menaxher fjal\u00ebkalimesh p\u00ebr t\u00eb ruajtur parametrat e hyrjes, si dhe p\u00ebr t\u00eb gjeneruar fjal\u00ebkalime nj\u00eb her\u00eb p\u00ebr verifikimin me dy faktor\u00eb, e cila i lejon p\u00ebrdorimin e metod\u00ebs s\u00eb diskutuar t\u00eb sulmit gjate autopopullimit t\u00eb fjal\u00ebkalimeve nj\u00eb her\u00eb. Si shembull, u demonstruar nj\u00eb sulm ndaj faqes issuetracker.google.com, e cila ka nj\u00eb dob\u00ebsi XSS. P\u00ebr t\u00eb marr\u00eb parametrat e hyrjes dhe kodin p\u00ebr verifikim me dy faktor\u00eb, mjafton t'i d\u00ebrgosh p\u00ebrdoruesit nj\u00eb lidhje q\u00eb shfryt\u00ebzon dob\u00ebsin\u00eb XSS dhe t\u00eb arrihesh tre klikime p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb k\u00ebrkesave t\u00eb rreme ngacmuese (miratimi i trajtimit t\u00eb Cookie, miratimi i personalizimit dhe pranimi i politik\u00ebs s\u00eb privat\u00ebsis\u00eb).
![\"Sulm](\"\/wp-content\/uploads\/2025\/08\/9df2f88789928b98278bb49ac8522c38.png\")
<\/center> <\/p>\n