Clickjacking: Not Just for the Clicks

This report demonstrates a clickjacking proof-of-concept that leverages HTML5 drag-and-drop to 'type' arbitrary values into hidden form fields within an iframed application, enabling attackers to socially engineer users (via a game-like drag action) to inject values—illustrated by a payroll adjustment demo that injects $10,000,000. The author provides a GitHub repo, reproduction steps, demo screenshots, and notes on practical limitations such as cross-frame drag restrictions.