SVG Clickjacking: A New Technique for Advanced Interactive Attacks and Data Exfiltration
By
spartanatreyu
Hot, fresh, and worth queueing round the block for.
Summary
The article introduces a novel cybersecurity technique called "SVG clickjacking" that significantly enhances traditional clickjacking attacks. Unlike classic clickjacking which only works for simple button presses, this new method using SVG filters enables complex interactive attacks and multiple forms of data exfiltration. The technique represents a powerful evolution of clickjacking that makes sophisticated attacks more feasible and dangerous.
Key quotes
· 4 pulledClickjacking is a classic attack that consists of covering up an iframe of some other website in an attempt to trick the user into unintentionally interacting with it.
I've discovered a new technique that turns classic clickjacking on its head and enables the creation of complex interactive clickjacking attacks, as well as multiple forms of data exfiltration.
I call this technique 'SVG clickjack'
It works great if you need to trick someone into pressing a button or two, but for anything more complicated it's kind of unrealistic.
You might also wanna read
Countermeasures Against Web Scrapers and Bots: Fighting Back with Creative Techniques
The article discusses techniques for fighting back against web scrapers and bots that inadvertently DDoS websites. The author describes vari
herman.bearblog.dev·6mo ago
Understanding Cross-Site Request Forgery (CSRF) Attacks and Countermeasures
The article explains Cross-Site Request Forgery (CSRF), a type of attack where an attacker tricks a user's browser into making unauthorized
Discovering and Removing a Hidden Reverse Shell on an Ubuntu Web Server
The article details the author's discovery of a hidden reverse shell running under the www-data user on their Ubuntu web server, highlightin
DEV Community·10mo ago
North Korean Chollima Group Targets PHP Developers via Malicious Packagist Package
A malicious obfuscated JavaScript payload was discovered appended to tailwind.js in the Packagist development version dev-drewroberts/featur
socket.dev·3h ago
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads
An npm package called "mouse5212-super-formatter" targeting Claude users acted as information-stealing malware, reaching 676 downloads befor
theregister.com·1d ago