shifa123 / clickjackingpoc

A Proof of Concept for Clickjacking Attacks

Clickjacking PoC

A tool made to make your clickjacking pocs better and easy.

Updated

Now catches the creds on the server logs and added message which asks for a cute bounty!

Overview

A web based ClickJacking PoC Tool.

Running

1. Make sure you have php installed (default installed on Kali/Parrot OS)
2. Download If not already there, can also use XAMPP.
3. In the downloaded directory run command root@rohit~ php -S localhost:8000 to start the PHP Server on port 8000.
4. Open up your browser and type localhost:8000
5. Type in your target website name in the box and hit load.
6. Drag and Drop the Login Buttons for PoC
7. Click on View
8. Your PoC is ready

clickjackingpoc's Issues

Sign in button not working

Hi, i cannot see the email ID and password as a pop up after pressing the sign up button using the NEW index.html

404 not found

root#php -S localhost:8000

Not Found

The requested resource / was not found on this server.

Username & Password is not getting printed in the server logs

Mon May  6 18:02:25 2024] PHP 8.1.2-1ubuntu2.17 Development Server (http://localhost:9000) started
[Mon May  6 18:03:13 2024] 127.0.0.1:54198 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54198 [200]: GET /
[Mon May  6 18:03:13 2024] 127.0.0.1:54198 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54202 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54204 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54202 [200]: GET /resources/css/bootstrap.css
[Mon May  6 18:03:13 2024] 127.0.0.1:54202 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54210 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54214 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54216 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54204 [200]: GET /resources/js/jquery-1.11.0.js
[Mon May  6 18:03:13 2024] 127.0.0.1:54204 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54210 [200]: GET /resources/css/jquery-ui.theme.css
[Mon May  6 18:03:13 2024] 127.0.0.1:54214 [200]: GET /resources/js/bootstrap.min.js
[Mon May  6 18:03:13 2024] 127.0.0.1:54210 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54214 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54216 [200]: GET /resources/js/jquery-ui.js
[Mon May  6 18:03:13 2024] 127.0.0.1:54216 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54230 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54242 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54230 [200]: GET /resources/img/small_logo.png
[Mon May  6 18:03:13 2024] 127.0.0.1:54230 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54242 [404]: GET /resources/css/images/ui-bg_gloss-wave_35_f6a828_500x100.png - No such file or directory
[Mon May  6 18:03:13 2024] 127.0.0.1:54242 Closing
[Mon May  6 18:03:13 2024] 127.0.0.1:54246 Accepted
[Mon May  6 18:03:13 2024] 127.0.0.1:54246 [200]: GET /resources/img/logo.ico
[Mon May  6 18:03:13 2024] 127.0.0.1:54246 Closing
[Mon May  6 18:04:01 2024] 127.0.0.1:44326 Accepted
[Mon May  6 18:04:01 2024] 127.0.0.1:44326 [200]: GET /sandbox.html?target=https://wwws-staging.moneytree.jp/link/&userNameLeft=883&userNameTop=412.921875&passwordLeft=885&passwordTop=471.921875&buttonLeft=1183&buttonTop=533.34375%26usernameStyle%3D%26passwordStyle%3D%26buttonStyle%3D%26customJavaScript%3D
[Mon May  6 18:04:01 2024] 127.0.0.1:44334 Accepted
[Mon May  6 18:04:01 2024] 127.0.0.1:44326 Closing
[Mon May  6 18:04:01 2024] 127.0.0.1:44334 [200]: GET /resources/js/jquery-1.11.0.js
[Mon May  6 18:04:01 2024] 127.0.0.1:44334 Closing




[Mon May  6 18:14:05 2024] 127.0.0.1:41428 Accepted
[Mon May  6 18:14:05 2024] 127.0.0.1:41428 [200]: GET /sandbox.html?target=https://wwws-staging.moneytree.jp/link/&userNameLeft=883&userNameTop=412.921875&passwordLeft=885&passwordTop=471.921875&buttonLeft=1183&buttonTop=533.34375%26usernameStyle%3D%26passwordStyle%3D%26buttonStyle%3D%26customJavaScript%3D
[Mon May  6 18:14:05 2024] 127.0.0.1:41428 Closing
[Mon May  6 18:14:05 2024] 127.0.0.1:41436 Accepted
[Mon May  6 18:14:05 2024] 127.0.0.1:41446 Accepted
[Mon May  6 18:14:05 2024] 127.0.0.1:41436 [200]: GET /resources/js/jquery-1.11.0.js
[Mon May  6 18:14:05 2024] 127.0.0.1:41436 Closing
[Mon May  6 18:15:05 2024] 127.0.0.1:41446 Closed without sending a request; it was probably just an unused speculative preconnection
[Mon May  6 18:15:05 2024] 127.0.0.1:41446 Closing

resources not found on server

resources not found on server please update resource on server

Root

Do I need root permissions to use?