Twitter new follow button clickjacking attack

pierz

Registered Member

Nov 9, 2009

58

65

• Jun 1, 2011

• #1

Yesterday Twitter released a new follow button which allow to instantly follow a user by clicking it if your connected.

I've done a POC to exploit this button through a clickjacking attack, it makes an invisible button which automatically follow the mouse of the user, hence, making him following you when he click everywhere on the site.

The exploit and the demo are available on my blog :
http://serphacker.com/twitter/twitter-new-follow-button-clickjacking-attack.html

 

robertw

BANNED

Feb 17, 2011

107

40

• Jun 1, 2011

• #2

thanks for the share, what is your method for implementing this script? Any results??

 

F

fung1990

Power Member

Dec 21, 2009

592

57

• Jun 1, 2011

• #3

you r awesome.

 

C

ch0pper

Newbie

Jun 21, 2009

42

0

• Jun 1, 2011

• #4

does this work on wordpress?

 

B

bookmarc

Elite Member

Jul 11, 2009

1,772

849

• Jun 1, 2011

• #5

does it work on phpbb?

 

Aim100IM

Elite Member

Jr. VIP

Nov 6, 2010

3,580

1,300

• Jun 1, 2011

• #6

M gonna chk it now. Lets see if it is actually as good as your post

 

C

clin407

Regular Member

Apr 6, 2011

418

129

• Jun 1, 2011

• #7

I'm logged into twitter and clicking on the demo page just makes a window popup.

 

sunbros

Regular Member

Apr 14, 2010

494

173

• Jun 1, 2011

• #8

thank you buddy

 

C

ch0pper

Newbie

Jun 21, 2009

42

0

• Jun 1, 2011

• #9

you have be logged on twitter for it two work

clin407 said:

I'm logged into twitter and clicking on the demo page just makes a window popup.

Click to expand...

 

C

clin407

Regular Member

Apr 6, 2011

418

129

• Jun 1, 2011

• #10

ch0pper said:

you have be logged on twitter for it two work

Click to expand...

My first few words mentioned I'm logged into Twitter, did you read that?

 

spirit of $

Registered Member

Mar 15, 2010

86

13

• Jun 1, 2011

• #11

Great share, I just try it too...very good. Thanks

 

U

unknown00

Regular Member

Jun 6, 2009

213

74

• Jun 2, 2011

• #12

nice!!

 

futurestic06

Supreme Member

Apr 16, 2011

1,204

149

• Jun 2, 2011

• #13

i have never heard about this and also don't believe it
how it is possible to guide my mouse where to click without me???????

 

pierz

Registered Member

Nov 9, 2009

58

65

• Jun 2, 2011
• Thread Starter Thread Starter

• #14

yes you can put it where you want WP/phpbb/whatever, it's just pure HTML/javascript. The script is just a demo, you could set the opacity to 0 in order to make the box invisible and catch the onclick event to remove the box immediatly after the user clicked. You can force the click by putting the button over an image/a link...

 

C

coolmaster82

Newbie

Jun 2, 2011

13

0

• Jun 2, 2011

• #15

cool stuff

 

M

masterfl

Junior Member

Apr 28, 2010

160

29

• Jun 2, 2011

• #16

your demo worked like a charm, now time to think of the best way to implement it ^__^

 

D

DavidHunke

Registered Member

Apr 23, 2011

59

6

• Jun 2, 2011

• #17

I think this will be working good with all and with wordpress too.

 

webworld99

Junior Member

Sep 6, 2009

101

16

• Jun 6, 2011

• #18

Ill pay $100 for detailed instructions on how to set this up and use. Someone help please

 

M

masterfl

Junior Member

Apr 28, 2010

160

29

• Jun 7, 2011

• #19

webworld99 said:

Ill pay $100 for detailed instructions on how to set this up and use. Someone help please

Click to expand...

it was a pleasure doing business with you. enjoy the modified version of the code

 

R

rawturtle

Newbie

Sep 27, 2009

36

6

• Jun 7, 2011

• #20

futurestic06 said:

i have never heard about this and also don't believe it
how it is possible to guide my mouse where to click without me???????

Click to expand...

It is the power summoned by Javascript.