No, this post is not about a Leon Schuster comedic skit from the early 90’s, YouTube reference here -> https://www.youtube.com/watch?v=JzoUBvdEk1k

To the point, once upon a time there was a tool called Jack which attempted to make ClickJacking PoC’ing a tad sexier and made it’s way to Black Hat EU 2015 Arsenal.

Some time has passed now since Jack was first released and was time for Jack to get some attention alas a new version of Jack has been released and can be found here, https://github.com/sensepost/jack .

The new release of Jack includes a whole new UI such that it is all Drag and Drop now with a single interface which makes those PoC’s for those dreaded reports a little easier. Jack’s source structure has also changed such that to run Jack, download the repo from Git and open “index.html” in your browser of choice and voila! The old UI of Jack is also available as “oldIndex.html”

Jack also includes a new payload option for custom JavaScript which you can provide and will be executed by the browser when Jack’s login button is clicked on the PoC page. Another little option in the new jack is that you can now save the PoC generated page and save the contents to be served by something like Apache just in case you want to take your PoC to the next level with malicious domains etc.