◐ Shell
reader mode source ↗
Skip to content
Merged

The clickjacking attack #308

Show file tree
Hide file tree
Changes from all commits
File filter
Conversations
Jump to
Diff view
Apply and reload
Show whitespace
Diff view
Apply and reload
2 changes: 1 addition & 1 deletion 3-frames-and-windows/06-clickjacking/clickjacking-visible.view/facebook.html
View file Edit file Delete file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

<body style="margin:10px;padding:10px">

<input type="button" onclick="alert('Like pressed on facebook.html!')" value="I LIKE IT !">

</body>

Expand Down
8 changes: 4 additions & 4 deletions 3-frames-and-windows/06-clickjacking/clickjacking-visible.view/index.html
View file Edit file Delete file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,14 +19,14 @@
}
</style>

<div>Click to get rich now:</div>

<!-- The url from the victim site -->
<iframe src="facebook.html"></iframe>

<button>Click here!</button>

<div>...And you're cool (I'm a cool hacker actually)!</div>

</body>
</html>
2 changes: 1 addition & 1 deletion 3-frames-and-windows/06-clickjacking/clickjacking.view/facebook.html
View file Edit file Delete file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

<body style="margin:10px;padding:10px">

<input type="button" onclick="alert('Like pressed on facebook.html!')" value="I LIKE IT !">

</body>

Expand Down
8 changes: 4 additions & 4 deletions 3-frames-and-windows/06-clickjacking/protector.view/iframe.html
View file Edit file Delete file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
<body>

<div id="protector">
<a href="/" target="_blank">Go to the site</a>
</div>

<script>
Expand All @@ -31,11 +31,11 @@

</script>

This text is always visible.

But if the page was open inside a document from another domain, the div over it would prevent any actions.

<button onclick="alert(1)">Click wouldn't work in that case</button>

</body>
</html>
2 changes: 1 addition & 1 deletion 3-frames-and-windows/06-clickjacking/top-location.view/iframe.html
View file Edit file Delete file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@

<body>

<div>Changes top.location to javascript.info</div>

<script>
top.location = 'https://javascript.info';
Expand Down
8 changes: 4 additions & 4 deletions 3-frames-and-windows/06-clickjacking/top-location.view/index.html
View file Edit file Delete file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@

window.onbeforeunload = function() {
window.onbeforeunload = null;
return "Want to leave without learning all the secrets (he-he)?";
};

document.body.insertAdjacentHTML('beforeend', '<iframe src="iframe.html">');
Expand All @@ -31,11 +31,11 @@

<body>

<p>After a click on the button the visitor gets a "strange" question about whether they want to leave.</p>

<p>Probably they would respond "No", and the iframe protection is hacked.</p>

<button onclick="attack()">Add a "protected" iframe</button>

</body>
</html>
Toggle all file notes Toggle all file annotations