Hello, everyone, and welcome to this video so long we have seen a couple of ways to identify click
checking based vulnerabilities, so we started with manually writing the code from Not Be Real Quick
Jack automated website, basically checking Testor.
We have seen a couple of tools as well that we wrote and we used it to identify click checking based
vulnerabilities with automated Busey's.
So I hope you guys understood this, but it would be incomplete without showing you the power of persued
box would also have awesome feature of ID of click tracking based vulnerability and creating a proof
of concept.
So let's quickly jump into this and let's see how can we utilize Bobzilla hidden feature of ID of click
checking based vulnerabilities.
So first of all, you have to start your bodysuit.
So I'm on to the professional version one point seven point three four.
I just need to click on Pop and I have to click on bop click banded.
So BOP Click Banded is the feature which is used to simulate and create a click Jianqing based PEOC.
All right, so we just need to click on copy click banded to clipboard.
So after you have clicked this, it will automatically copy the code that we are going to use.
Now you just need to go to your browser.
So as you can see, I'm onto my browser right now.
So let me just bring it over here.
Let me reload this as well.
So once you're onto your browser, you have to really click and go to inspect element.
So once you're into the inspect element, go to your console tab and based what we have copied from
there and hit enter.
So once you hit enter, you can see orange glow message over to your screen with this Bob click banded
Elegante.
It is a start finish and on the right hand side it sets record mode.
All right.
So we are going to start you see for that you just need to hit on start.
Once you click on start, it will automatically enable the application that you are going to test for
click jacking based on the abilities.
As you can see, it has successfully loaded into your iFrame, so we have identified it to be vulnerable.
Now we are going to make a few clicks to make up, you see.
So let's assume there is a button which is a delete button over here, which is a sensitive action.
So let's say let's assume this is the delete button for now.
So what we are going to do is we are going to create a PEOC with a sensitive action over here.
So once we have started this, as you can see over here.
So let's click on this so you can see we have been successfully logged out.
Let's go back to your profile, click on user name, click on.
Let's try to log in again.
And again, log in, click on Will, click on login, and again, we have successfully logged in.
And again, let me click on Log Test.
All right, now let me click on finish and let's see our posse that has been successfully created so
we can see or hear click.
So let me just click over here second click on your profile.
Totally over here.
We have to fill the credentials that is test test and click on login.
And then we get successfully logged in and we click on the logout button over here, which was assumed
to be over delete button.
And again, see if we got a successful message that says you have been clicked and now you just simply
can click on toggle transparency and you cannot see what the application is hidden in the background.
Let me just reset this.
Now, when you reset, everything becomes back to normal, and now we can again start creating our posse.
So to create the posse again, you have to base the code that we have copied over here.
So let me be straight over here.
Hit enter again.
Click on start.
Let's go to your profile, let's quickly logon because it was locked out.
And let's assume this is the delete button, so let's clear this, all right, let's click on Finish
and again, see, these are the clicks that we have made first here.
Then we clicked on the login button and then we clicked over and logged in and then we clicked on the
button.
But we assumed as our delete button.
So you can see you have been successfully clicked back.
So you can see this as well.
So let me just save this.
So let's say we open this with Google Chrome and you can see these are the steps.
And click on login.
You can see this was the delete button that we created now for demonstration purposes, guys, your
is the transparency, which is like this.
So I can also toggle the transparency and save this now again.
And now you can see we can break the victim in saying this is a game and click over here.
So when the victim clicks over here, what will happen is he is unknowingly clicking on the delete button.
And once he clicks on the delete button, there will be his account deleted from the application.
As you can see, this was for demonstration purposes.
That's why we can see you have been click, Jack.
So I hope you guys understood this.
Thank you.