# DoubleClickjacking (POC's)

{% hint style="info" %}
This POC's is created based on the research of PAULOS YIBELO ref: <https://www.paulosyibelo.com/>
{% endhint %}

## Description:

**DoubleClickjacking** is a new twist on traditional clickjacking attacks. Instead of relying on a single click, it exploits a double-click sequence to bypass established protections like the X-Frame-Options header or SameSite: Lax/Strict cookies. This novel technique has widespread implications, potentially impacting almost every website and enabling account takeovers on numerous major platforms.

## Attack Flow:

\
DoubleClickjacking exploits a subtle flaw in timing and event sequencing:

1. The attacker creates an initial webpage with a button that either opens a new window or does so automatically.
2. When the user interacts with the button:
   * A new window appears on top, prompting the user to "double-click."
   * This new window uses `window.opener.location` to redirect the parent window to the target page.
3. At this point:
   * The parent window displays the target page, while the top window still shows the double-click prompt.
4. When the user follows the prompt to double-click:
   * The first click (triggered on `mousedown`) closes the top window.
   * The second click, now targeting the parent window, unknowingly interacts with a sensitive element like an authorization button.

As a result, the user inadvertently grants the attacker’s application access to their account with arbitrary permissions.

<figure><img src="https://433638669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMlb0Ea0cOzVN7lJPHIpJ%2Fuploads%2Fl43gVlkzhHncFrgEjApE%2Fdouble%20click.png?alt=media&#x26;token=cf96875c-f4f0-4e4f-838e-29dfcc770eff" alt=""><figcaption></figcaption></figure>

## How it can be exploited:

* **OAuth & API Permissions:** Attackers could trick targets into authorizing a malicious application with extensive privileges. This technique has unfortunately led to account takeovers in almost every site that supports OAuth - which is pretty much all major websites with an API support.  And even if by some miracle it is detected and the user tries to revoke the a malicious attacker app, it would already be too late since it could perform its malicious actions the instant it is authorized.<br>
* **One-Click Account Changes:** Similar to classic clickjacking, DoubleClickjacking can be used to make the user click on account-setting changes, such as disabling security settings, deleting an account, authorizing access or money transfers, or confirming transactions, etc.

## POC's:

> <https://double-clickjacking-sibivasan.vercel.app/Safe.html>

We have developed a tool to simplify testing for DoubleClickjacking.

<figure><img src="https://433638669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMlb0Ea0cOzVN7lJPHIpJ%2Fuploads%2FtIXnqIIt6aPsCXtO3LIM%2Fimage.png?alt=media&#x26;token=26ca132d-d70d-4edc-b220-f53ae0821c28" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Enter the URL:** We have to provide the target website.

**Up or Down:** We have to provide the value to move the double click button Up or down.

**Left:** We have to provide the value to move the double click button Lef&#x74;**.**

**Width:** We have to provide the value to increase or decrease the width.\
**Height:** We have to provide the value to increase or decrease the height.
{% endhint %}

{% embed url="<https://youtu.be/4rGvRRMrD18?si=wTab3jgNgvRMidlx>" %}

Thanks for Reading this blog :)
