Security article
Basic clickjacking with CSRF token protection
Basic clickjacking with CSRF token protection: To solve the lab, craft some HTML that frames the account page and fools the user into deleting their account. The lab is solved when the account is deleted. • PortSwigger • CSRF, Clickjacking • clickjacking, csrf
This lab contains login functionality and a delete account button that is protected by a [CSRF token](https://portswigger.net/web-security/csrf/tokens). A user will click on elements that display the word "click" on a decoy website.To solve the lab, craft some HTML that frames the account page and fools the user into deleting their account. The lab is solved when the account is deleted.
You can log in to your own account using the following credentials: wiener:peter
Note
The victim will be using Chrome so test your exploit on that browser.
In first place we login as the user
afterwards we make an iframe in a own html iframe where we set the src as the xxx/my-account
Afterwards the page looks like below:
