SVG Filters - Clickjacking 2.0

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://lyra.horse/blog/2025/12/svg-clickjacking/
• Blog Title: SVG Filters - Clickjacking 2.0
• Suggested Section: Pentesting Web -> Clickjacking (new subsection: 'SVG Filters / Cross-Origin Iframe UI Redressing')

🎯 Content Summary

This post presents a new, highly programmable UI-redressing technique the author calls SVG clickjacking. It abuses the fact that modern browsers allow powerful SVG filters (via CSS filter:url(#id)) to be applied directly to cross-origin iframes. While DOM and JS access are still protected by the Same Origin Policy, the browser’s rendering pipeline supplies the iframe’s rasterized pixels to the SVG filter as SourceGraphic, and almost ...

🔧 Technical Details

Trick 1 – Distort cross-origin secrets into fake CAPTCHAs with feTurbulence + feDisplacementMap
If a sensitive code or token is displayed inside a framable endpoint, an attacker can wrap the cross-origin iframe with an SVG filter that visually distorts the underlying text using <feTurbulence> and <feDisplacementMap>, for example:
<filter id="captchaFilter"><feTurbulence type="turbulence" baseFrequency="0.03" numOctaves="4" result="turbulence"/><feDisplacementMap in="SourceGraphic" in2="turbulence" scale="6" xChannelSelector="R" yChannelSelector="G"/></filter>
The rendered text looks like a CAPTCHA but remains legible to users. The attacker then places an HTML input on their own page and validates it with a strict pattern matching the underlying secret (e.g., hex code such as ^6c79 ?7261 ?706f ?6e79$). Users believe they are solving a CAPTCHA and retype th...

🤖 Agent Actions

Summary:

• Added a new “SVG Filters / Cross-Origin Iframe UI Redressing” section to the clickjacking page explaining how CSS filter:url(#id) chains can rewrite cross-origin iframe pixels, the SVG primitives that enable it, and how attackers distort secrets, recontextualize inputs, derive pixel-based booleans, and drive multi-step stateful overlays.
• Included illustrative filter snippets plus mitigation notes emphasizing frame blocking and the limitations of defense-in-depth against this technique.
• Updated the references list with the “SVG Filters – Clickjacking 2.0” source.

Tests: Not run (not applicable).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://lyra.horse/blog/2025/12/svg-clickjacking/

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Clickjacking (new subsection: 'SVG Filters / Cross-Origin Iframe UI Redressing')".

Repository Maintenance:

• MD Files Formatting: 914 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0