Mutillidae Click Jacking
PreviousThrough clickjacking, we have controlled the webpage and hijacked the page.
Why is Click-jack Attacked?
You may have seen it sometimes, when you click on some website page, an unnecessary page opens, all these of work are part of Click-jacking. With the click-jacking, we can get the mouse to work on every event, Like page-likes, send page to another page, infinite pop up loop on web page etc.
Redirect attack on page
Example Security label : 0,1
- First open where you can insert something Like, registration page or add blog page or comment post page
- Now write the javaScript code as you want , here we are using the redirect page using mouse move.
- Do with this example , just copy and paste it on your input box and post it.
<script>
document.getElementsByTagName("body")[0].setAttribute("onmouseover", "redirectPage()");
function redirectPage(){
window.location ="https://www.google.com/";
}
</script>
Click-jacking successful , now move your mouse anywhere your given redirect page will open
Open infinite browser tab attack
- In this example we will open at least 5 tabs of the browser
- If you want, you can open the tab by running an infinite loop, any browser has a limit as to which tab it can open, after then the browser crashes
- Do with this example , just copy and paste it on your input box and post it.
<script>
document.getElementsByTagName("body")[0].setAttribute("onclick", "manyTabOpen()");
function manyTabOpen(){
for (var i=0;i<5;i++){
window.open("https://www.google.com","_blank");
}
}
</script>
As soon as you open the page, the browser will ask you for permission of the popup allow you to allow
Then the attack will be successful, now you can modify it according to your own and use some other method, and you should also
Let me give you an example for practice
1. Alert box attack in browser
2. Add a function to the tag with the help of the attribute and then run any function by writing an attack code
3. On the first click on a link, an unnecessary page is opened and click again but the real page is open.
💡 Tip: You must have basic knowledge of JavaScript for click jacking.
Previous