Other nomination

setTimeout Clickjacking

A clickjacking demo against Flash camera and microphone permissions: opacity still hides the Flash prompt in Chrome, and a user-initiated popup later sent to a data: URL whose declared charset is padded with a fake google.com string makes the address bar read like Google. The victim then clicks through a permission dialog they believe belongs to a trusted site.

Record

Published by

blog.whitehatsec.com

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Tags

• clickjacking
• ui-redress
• flash
• charset
• url-parsing
• javascript
• owasp-a02-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of blog.whitehatsec.com, first published at the original source. Preserved copies are kept so the citation survives its host.