1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Twitter new follow button clickjacking attack

Discussion in 'Black Hat SEO' started by pierz, Jun 1, 2011.

  1. pierz

    pierz Registered Member

    Joined:
    Nov 9, 2009
    Messages:
    58
    Likes Received:
    64
    Location:
    France
    Home Page:
    Yesterday Twitter released a new follow button which allow to instantly follow a user by clicking it if your connected.

    I've done a POC to exploit this button through a clickjacking attack, it makes an invisible button which automatically follow the mouse of the user, hence, making him following you when he click everywhere on the site.

    The exploit and the demo are available on my blog :
    http://serphacker.com/twitter/twitter-new-follow-button-clickjacking-attack.html
     
    • Thanks Thanks x 11
  2. robertw

    robertw BANNED BANNED

    Joined:
    Feb 17, 2011
    Messages:
    107
    Likes Received:
    40
    thanks for the share, what is your method for implementing this script? Any results??
     
  3. fung1990

    fung1990 Power Member

    Joined:
    Dec 21, 2009
    Messages:
    577
    Likes Received:
    51
    you r awesome.
     
  4. ch0pper

    ch0pper Newbie

    Joined:
    Jun 21, 2009
    Messages:
    42
    Likes Received:
    0
    does this work on wordpress?
     
  5. bookmarc

    bookmarc Senior Member

    Joined:
    Jul 11, 2009
    Messages:
    1,052
    Likes Received:
    480
    does it work on phpbb?
     
  6. seoguy99

    seoguy99 Jr. VIP Jr. VIP

    Joined:
    Nov 6, 2010
    Messages:
    2,305
    Likes Received:
    513
    Occupation:
    SEO
    Home Page:
    M gonna chk it now. Lets see if it is actually as good as your post :)
     
  7. clin407

    clin407 Regular Member

    Joined:
    Apr 6, 2011
    Messages:
    418
    Likes Received:
    129
    I'm logged into twitter and clicking on the demo page just makes a window popup.
     
  8. sunbros

    sunbros Regular Member

    Joined:
    Apr 14, 2010
    Messages:
    378
    Likes Received:
    125
    thank you buddy
     
  9. ch0pper

    ch0pper Newbie

    Joined:
    Jun 21, 2009
    Messages:
    42
    Likes Received:
    0
    you have be logged on twitter for it two work

     
  10. clin407

    clin407 Regular Member

    Joined:
    Apr 6, 2011
    Messages:
    418
    Likes Received:
    129
    My first few words mentioned I'm logged into Twitter, did you read that?
     
  11. spirit of $

    spirit of $ Registered Member

    Joined:
    Mar 15, 2010
    Messages:
    86
    Likes Received:
    13
    Occupation:
    Internet
    Great share, I just try it too...very good. Thanks
     
  12. unknown00

    unknown00 Regular Member

    Joined:
    Jun 6, 2009
    Messages:
    212
    Likes Received:
    74
    nice!!
     
  13. futurestic06

    futurestic06 Supreme Member

    Joined:
    Apr 16, 2011
    Messages:
    1,204
    Likes Received:
    146
    i have never heard about this and also don't believe it :p
    how it is possible to guide my mouse where to click without me???????
     
  14. pierz

    pierz Registered Member

    Joined:
    Nov 9, 2009
    Messages:
    58
    Likes Received:
    64
    Location:
    France
    Home Page:
    yes you can put it where you want WP/phpbb/whatever, it's just pure HTML/javascript. The script is just a demo, you could set the opacity to 0 in order to make the box invisible and catch the onclick event to remove the box immediatly after the user clicked. You can force the click by putting the button over an image/a link...
     
  15. coolmaster82

    coolmaster82 Newbie

    Joined:
    Jun 2, 2011
    Messages:
    13
    Likes Received:
    0
    cool stuff
     
  16. masterfl

    masterfl Junior Member

    Joined:
    Apr 28, 2010
    Messages:
    160
    Likes Received:
    29
    Occupation:
    Fulltime Web Developer, Newbie IM
    Location:
    Philippines
    Home Page:
    your demo worked like a charm, now time to think of the best way to implement it ^__^
     
  17. DavidHunke

    DavidHunke Registered Member

    Joined:
    Apr 23, 2011
    Messages:
    59
    Likes Received:
    6
    I think this will be working good with all and with wordpress too.
     
  18. webworld99

    webworld99 Junior Member

    Joined:
    Sep 6, 2009
    Messages:
    101
    Likes Received:
    16
    Ill pay $100 for detailed instructions on how to set this up and use. Someone help please
     
    • Thanks Thanks x 1
  19. masterfl

    masterfl Junior Member

    Joined:
    Apr 28, 2010
    Messages:
    160
    Likes Received:
    29
    Occupation:
    Fulltime Web Developer, Newbie IM
    Location:
    Philippines
    Home Page:
    it was a pleasure doing business with you. enjoy the modified version of the code
     
  20. rawturtle

    rawturtle Newbie

    Joined:
    Sep 27, 2009
    Messages:
    36
    Likes Received:
    6

    It is the power summoned by Javascript. :)