Social phishing (user identification). How does it work?

Question

PHP

Interested in how the identification of users of social networks works. Such functionality is provided, for example, by socfishing.ru
I myself fell for this "bait" when I went to the legal site, did not log in anywhere, did not order anything, and after a couple of hours a message arrives in VK from their manager "Hello, you visited our site .. blah blah"
That is, the user enters the site-> the service determines his account in the social. networks.
How it works? Looked api Vkontakte - found nothing similar. In fact, it all comes down to how to find out the user id. Further information can already be pulled out through api.

Answer 1

A hidden "Like" VKontakte widget generated using the JS API is inserted into the site.
This widget is constantly under the cursor, when pressed, the JS API calls an Event with all user data. They are sent as a post request to the server.
To hide the fact of clickjacking from the user, the script also determines the object by the click coordinates and calls its click trigger.

Answer 2

As far as I know Clickjacking is used

Answer 3

Here is the finished code https://github.com/romkagolovadvayha/romkagolovadv...
The only thing I would fix is
​​https://github.com/romkagolovadvayha/romkagolovadv...
it's better to generate a different LIKE_ID for each user and save it somewhere in localstorage

Answer 4

https://habrahabr.ru/post/234067/ there in the comments there was a description of how it works.

Answer 5

VK has an authorization button on the site, the button is made hidden and an on-click handler is assigned, then authorization occurs. In short: VC are complete deer, moreover, they do not even consider this a vulnerability.

Answer 6

For firefox there is such a wonderful thing - the privacy suite, which does a lot of things, including removing such buttons from pages

Answer 7

For all the time of working with social phishing services, I managed to understand the mechanism of work.
The basis of the whole system lies in clickjacking and button liking.
Api vkontakte allows you to find out the id of the one who clicked on the like.
The main difficulty is in determining whether a user is logged in or not, as well as in bypassing Yandex bans.
Luckily, the service that we currently use traffgui.ru allows you to avoid blocking from Yandex.