Who Said ClickJacking Is Dead ! NEW Method > ClickJack Facebook, Twitter and Google Plus > Working 2015 !

[xenodk]

Hi,

The click "like" event changes to a confirm link after its triggered, clicking again pops up the FB like window. Is there a way to skip the confirm so clicks will like directly?

/Xenodk

[villecity]

(01-21-2015 03:54 AM)bobdos007 Wrote:  Hey guys, girls if any!

After hearing some news that clickjacking is patched by facebook and others, I made an extensive search and i found this code as a way to show how you might hide an embedded object into a website in order to execute a successful ClickJacking attack. This code will maliciously force the user, or the visitor, to Silently ‘Like’ or +1 a particular page on Facebook or Google+, or add twitter followers.

How the Code Works:

• User visits the page -> jQuery script is executed
• The script detects which social media sites the user is logged into (Facebook, Twitter, or Google+)
• If the script detects a login from any of those sites, it will iterate down the list and pick the first of the logged in sites (for this example, let’s use Facebook)
• Using HTML, CSS, and Javascript/jQuery, a hidden button will be loaded and tied to the user’s mouse click event
• When the mouse is clicked, the button will trigger and execute a particular function tied to Facebook, Twitter, or Google. In this case, the button is a ‘Like’, and the user has unknowingly liked a page on Facebook.
• The script then unloads, and drops a cookie indicating the the Facebook script has been run
• If the script has been placed in a website’s header, it will reload the next time the user visits a different page on the site. This time the script will detect the clickjack’s ‘Facebook complete’ cookie and automatically iterate to the next logged in service.
  

Live DEMOOO:

http://www.nightlionsecurity.com/scripts/cj/

Download Link:

http://www42.zippyshare.com/v/Kyb4l33B/file.html

Using the Code

• Each of the social network functions have specific opacity settings.These are currently set to VISIBLE (1). If you would like to go into stealth mode and hide the buttons, change all the ‘opacity’ settings to 0 (I will eventually make this a global option).
• You must specific your account in the parameters of each of the social networks. Replace all instances of “[YOURNAME]” with your account name.
• Execution of the Facebook code requires a Facebook APP ID. The app ID you are using must have the same domain name as the script. This code is located in index.html
• The login status messages can be safely removed form the HTML file without effecting the rest of the code.

Other Tutorials/Shares you may want to check:

[Tutorial] How To Get Free Domain From Godaddy With Hosting For Only $12/year

[GET] [FULL Ebook] Advanced Google Adwords V3

Could this be used on a wordpress.com site?

[midascodebreaker]

Got it working all modules :) thanks

[adimar33]

can you explain how? you get to work

[basuraza]

Amazing and working, rep added bobdos007.
Anyone knows about any Cookie Steath method working this days? Any idea? Thanks
If you could offer me one solution in private
Thanks

[rajeevrrs]

what about adsense

[bobdos007]

(01-23-2015 07:22 AM)iyuri305 Wrote:  Got it working all modules :) thanks

Glad to hear that !

[dooyood]

Nice Post .. Thanks for sharing

[bobdos007]

(01-31-2015 09:35 AM)dooyood Wrote:  Nice Post .. Thanks for sharing

You are welcome dude

[Brett Saucer]

how to get likes by using this?