Clickjacking using Base64 encoding. How they do this ?

Came across usercloud.com.
when you click on download, it actually pops-up a new tab with base64 code which redirects to the same download page again and the original page is loaded with offers. you have to click 1 more time which does the same job.
3rd time it takes you to the actual download.

how to do this ?
please share your thoughts

Here is the example download page. hxxps://userscloud.com/hcm1xgxitlff

I think you're wrong, I have not noticed any Base64 here. Nothing happens when you click on the "Download" button. What pops up is a standard pop-up(i.e. it pops up if you click anywhere)...

I'm not wrong.

Somebody with experience, can you please have a look at it ?

blackmint said:

I'm not wrong.

Somebody with experience, can you please have a look at it ?

Click to expand...

That is data uri. Look it up

https://en.wikipedia.org/wiki/Data_URI_scheme
http://lmgtfy.com/?q=data+uri

It just doesn't open in my case, but... It opens a window/tab with that URL("data:text/html;base64,...") and your browser treats it as the response(decodes at first). This seems to bypass AdBlock, because it can only operate on HTTP protocol(i.e. URLs that start with "http(s)://").

So if you want to do the same, write some HTML, encode it as Base64, and open a new window using the data URI.
An example:
HTML:
As Base64:
As data URI:
Opening a window:

i got that part.
what i didn't get is how to reload the same page in new tab and load the advertiser offers on main tab for 2 consecutive clicks.
everything works perfect on 3rd click.
You can't bypass this. i think it is a hidden iframe with jacking script.

Okey, so you hooked me on this and I dug deep.

If you look at the HTML source you'll find a JavaScript snipped at line ~433. This is 'packed' JS code (hence the function name 'function(p,a,c,k,e,d)') that gets evaluated/executed once it loads.
There are online tools for unpacking such code snippets, I used //matthewfl.com/unPacker.html and could then read the actual code, //pastebin.com/YRzxbYYX.

What it does is that it dynamically loads the AD-script from //likablescaldfelted.info/ads/ads.js and then makes a DIV covering the whole view space. This DIV has an event listener that will fire when clicked.
As for how they check whether it's the third time clicked or not it appears that they use a simple cookie . You can find this in the unpacked code where the variable k gets declared.

TL;DR: they use a cookie.