{"id":141439,"date":"2025-08-24T11:11:56","date_gmt":"2025-08-24T09:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking"},"modified":"2026-01-24T17:56:45","modified_gmt":"2026-01-24T15:56:45","slug":"ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/ataka-na-brauzernye-dopolneniya-s-menedzherami-parolej-ispolzuyushhaya-klikdzheking","title":{"rendered":"Sulmi ndaj shtesave t\u00eb shfletuesve me menaxher\u00eb fjal\u00ebkalimi, duke p\u00ebrdorur klikdhekinng","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb konferenc\u00ebn DEF CON 33 u paraqit nj\u00eb metod\u00eb sulmi ndaj shtesave t\u00eb shfletuesit, t\u00eb cilat vendosin elemente t\u00eb tyre t\u00eb nd\u00ebrfaqes n\u00eb faqen e vizituar. Zbatimi i sulmit ndaj shtesave me menaxher\u00ebt e fjal\u00ebkalimeve mund t\u00eb \u00e7oj\u00eb n\u00eb rrjedhjen e informacionit t\u00eb ruajtur n\u00eb menaxher\u00ebt e fjal\u00ebkalimeve, si\u00e7 jan\u00eb parametrat e autentifikimit, t\u00eb dh\u00ebnat e kartave t\u00eb kreditit, informacioni personal dhe fjal\u00ebkalimat nj\u00ebher\u00ebsh p\u00ebr autentifikimin me dy faktor\u00eb. Problemi prek t\u00eb gjith\u00eb menaxher\u00ebt e fjal\u00ebkalimeve t\u00eb testuar, p\u00ebrfshir\u00eb 1Password, Bitwarden, LastPass, KeePassXC-Browser, NordPass, ProtonPass dhe Keeper. <\/p>\n
Metoda e sulmit bazohet n\u00eb faktin se shtesat e shfletuesit paraqesin nj\u00eb dialog p\u00ebr k\u00ebrkes\u00ebn e automatizimit t\u00eb fjal\u00ebkalimit drejtp\u00ebrdrejt n\u00eb faqen e shfaqur, duke integruar elementet e tyre n\u00eb DOM (Modelin e Objektit Dokumentit) t\u00eb k\u00ebsaj faqe. N\u00ebse sulmuesi ka mund\u00ebsin\u00eb t\u00eb ekzekutoj\u00eb kodin e tij JavaScript n\u00eb faqe, p\u00ebr shembull, duke shfryt\u00ebzuar nj\u00eb dob\u00ebsi XSS n\u00eb faqen e internetit, ai mund t\u00eb manipuloj\u00eb t\u00eb gjith\u00eb elementet n\u00eb DOM, p\u00ebrfshir\u00eb shtesat e shfletuesit t\u00eb vendosura. <\/p>\n
P\u00ebrve\u00e7 t\u00eb tjerave, ekziston mund\u00ebsia p\u00ebr t\u00eb b\u00ebr\u00eb dialogun e konfirmimit transparent dhe p\u00ebr t\u00eb p\u00ebrputhur hap\u00ebsir\u00ebn e butonit n\u00eb k\u00ebt\u00eb dialog me butonin e dialogut t\u00eb rrem\u00eb t\u00eb krijuar nga sulmuesi q\u00eb stimulon p\u00ebrdoruesin t\u00eb klikoje. Si dialog\u00eb t\u00eb till\u00eb t\u00eb rrem\u00eb mund t\u00eb p\u00ebrdoren k\u00ebrkesa fiktive p\u00ebr autorizimin e pun\u00ebs me Cookies, bannerat reklamues ose format me CAPTCHA. Duke vendosur dialogun e rrem\u00eb n\u00ebn dialogun transparent t\u00eb menaxherit t\u00eb fjal\u00ebkalimeve dhe duke p\u00ebrputhur vendndodhjen e butonave n\u00eb ekran, mund t\u00eb arrihet q\u00eb kliku i p\u00ebrdoruesit t\u00eb shkoj\u00eb n\u00eb butonin e konfirmimit t\u00eb plot\u00ebsimit t\u00eb parametrave t\u00eb autentifikimit n\u00eb dialogun e menaxherit t\u00eb fjal\u00ebkalimeve, edhe pse p\u00ebrdoruesi do t\u00eb besonte se kishte klikuar, p\u00ebr shembull, n\u00eb butonin e mbylljes s\u00eb dritares me reklam\u00ebn.
<\/center> <\/p>\n
Sulmi p\u00ebrb\u00ebhet nga hapat e m\u00ebposht\u00ebm: <\/p>\n
\n
Krijimi i nj\u00eb elementi ngacmues n\u00eb faqe, i cili stimulon kryerjen e nj\u00eb kliku.\n
Shtimi i nj\u00eb forme web n\u00eb faqe p\u00ebr ky\u00e7je ose p\u00ebrplot\u00ebsim t\u00eb t\u00eb dh\u00ebnave personale.\n
Vendosja e transparenc\u00ebs p\u00ebr formular\u00ebt web («opacity: 0.001» n\u00eb CSS).\n
P\u00ebrdorimi i metod\u00ebs focus() p\u00ebr t\u00eb vendosur fokusin e hyrjes n\u00eb fush\u00ebn n\u00eb form\u00eb, duke \u00e7uar n\u00eb aktivizimin e dialogut t\u00eb automatizimit t\u00eb menaxherit t\u00eb fjal\u00ebkalimeve.\n
K\u00ebrkimi i dialogut t\u00eb menaxherit t\u00eb fjal\u00ebkalimeve q\u00eb \u00ebsht\u00eb shfaqur n\u00eb DOM dhe vendosja e transparenc\u00ebs p\u00ebr t\u00eb.\n
Pritja e klikimit t\u00eb p\u00ebrdoruesit n\u00eb nj\u00eb element t\u00eb duksh\u00ebm t\u00eb bezdissh\u00ebm n\u00eb faqe, i cili, me nj\u00eb p\u00ebrputhje t\u00eb duhur t\u00eb elementeve t\u00eb duksh\u00ebm dhe t\u00eb pa duksh\u00ebm, do t\u00eb \u00e7oj\u00eb n\u00eb klikimin e butonit n\u00eb dialogun e qart\u00eb dhe plot\u00ebsimin e fushave nga menaxheri i fjal\u00ebkalimeve.\n
Ekstraktimi i t\u00eb dh\u00ebnave nga forma web e plot\u00ebsuar dhe d\u00ebrgimi i tyre n\u00eb serverin e sulmuesit. <\/ul>\n
Duke qen\u00eb se plot\u00ebsimi automatik i parametrave t\u00eb autentifikimit n\u00eb menaxherin e fjal\u00ebkalimeve aktivizohet vet\u00ebm p\u00ebr faqet n\u00eb t\u00eb cilat k\u00ebta parametra jan\u00eb ruajtur, p\u00ebr t\u00eb organizuar nj\u00eb sulm \u00ebsht\u00eb e nevojshme t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb nisur kodin tuaj JavaScript n\u00eb faqen target apo n\u00eb n\u00ebn-domenin e saj. K\u00ebshtu, p\u00ebr sulmin \u00ebsht\u00eb e nevojshme ose t\u00eb fitohet nj\u00eb n\u00ebn-domen n\u00eb t\u00eb nj\u00ebjtin domen si faqja e sulmuar, ose t\u00eb gjendet nj\u00eb dob\u00ebsi XSS n\u00eb faqe q\u00eb lejon inkorporimin e kodit tuaj n\u00eb p\u00ebrmbajtjen e dukshme p\u00ebr p\u00ebrdoruesin. <\/p>\n
V\u00ebrehet se shum\u00eb p\u00ebrdorues p\u00ebrdorin nj\u00eb menaxher fjal\u00ebkalimi si p\u00ebr ruajtjen e parametrave t\u00eb hyrjes ashtu edhe p\u00ebr krijimin e fjal\u00ebkalimeve nj\u00eb her\u00ebshe p\u00ebr autentifikimin me dy faktor\u00eb, e cila lejon p\u00ebrdorimin e metod\u00ebs s\u00eb sulmit t\u00eb shqyrtuar gjat\u00eb plot\u00ebsimit automatik t\u00eb fjal\u00ebkalimeve nj\u00eb her\u00ebshe. Si nj\u00eb shembull, \u00ebsht\u00eb demonstruar nj\u00eb sulm ndaj faqes issuetracker.google.com, e cila ka nj\u00eb dob\u00ebsi XSS. P\u00ebr t\u00eb marr\u00eb parametrat e hyrjes dhe kodin p\u00ebr autentifikimin me dy faktor\u00eb, mjafton t\u00eb d\u00ebrgohet p\u00ebrdoruesit nj\u00eb lidhje q\u00eb shfryt\u00ebzon dob\u00ebsin\u00eb XSS dhe t\u00eb arrihen tre klikime p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb k\u00ebrkesave t\u00eb rreme bezdisshm\u00ebris\u00eb (leja e trajtimit t\u00eb Cookie-ve, leja e personalizimit dhe pajtimi me politik\u00ebn e mbrojtjes s\u00eb privat\u00ebsis\u00eb).
![\"Sulmi](\"\/wp-content\/uploads\/2025\/08\/9df2f88789928b98278bb49ac8522c38.png\")
<\/center> <\/p>\n