ClickJacking

[tonynuc]

google it yourself

or see the demo of a game that will hijack your webcam.

[lucifer]

Overview:
Typically there is one type of attack - cross site request forgeries (CSRF) that can interact with functions on other websites. The primary defense against CSRF is to create one time tokens (nonces) that are placed on the page and validated on supplemental pages, to ensure that the browser indeed picked up the nonce. Nonce evasion requires that the browser somehow gains access to data in another domain. Barring any client side vulnerabilities, reading cross domain is supposed to be disallowed by virtue of the browser's same origin policy. Clickjacking, however, evades the need for this cross domain reading, and instead directly places the mouse over the target area to click on the link or form that contains the nonce - thereby bypassing the need for client side cross domain read exploitation.


More Details Read Here

**Hidden Content: To see this hidden content your post count must be 25 or greater.**