Introduction to Clickjacking with form input data prefilled from a URL parameter

Clickjacking with form input data prefilled from a URL parameter is a web security vulnerability where an attacker manipulates a webpage to overlay a malicious element on a legitimate form. This can lead to unauthorized actions, sensitive information disclosure, and manipulation of user-submitted data. To mitigate this risk, web developers should implement preventive measures like frame-busting techniques, X-Frame-Options headers, and Content-Security-Policy frame-ancestors directive. Additionally, input validation and sanitization should be performed to ensure user-supplied data is properly validated and sanitized. Prioritizing web security, implementing countermeasures, and conducting regular security assessments can minimize the risk of clickjacking attacks with pre-filled form input data, protecting user data, preventing unauthorized actions, and maintaining a secure browsing experience.

Lab Solutions | Practical Work Time

This lab extends the basic clickjacking example in Lab: Basic clickjacking with CSRF token protection. The goal of the lab is to change the email address of the user by prepopulating a form using a URL parameter and enticing the user to inadvertently click on an “Update email” button.

To solve the lab, craft some HTML that frames the account page and fools the user into updating their email address by clicking on a “Click me” decoy. The lab is solved when the email address is changed.

You can log in to your own account using the following credentials: wiener:peter

Stepwise Solution of the lab:-

After accessing this lab, we first noticed My account.

Without any further ado, click on My account.

Well, it’s a login form, Right?

As following credentials: wiener:peter . We filled it now click on Log in.

We logged in and saw that it has a few functionality. Now we will apply our clickjacking technique into it. Now simply click on Go to exploit server.

After clicking on Go to exploit server scroll down a little bit. Now paste the below payload into the body section.

<style>
    iframe {
        position:relative;
        width:$width_value;
        height: $height_value;
        opacity: $opacity;
        z-index: 2;
    }
    div {
        position:absolute;
        top:$top_value;
        left:$side_value;
        z-index: 1;
    }
</style>
<div>Test me</div>
<iframe src="YOUR-LAB-ID.web-security-academy.net/my-account?email=hacker@attacker-website.com"></iframe>

First of all, let me remind you to understand the overview of this lab. You need some basic knowledge of HTML iframe tag & CSS. Now what I did is replace YOUR-LAB-ID.web-security-academy.net/my-account to my LAB link. And according to my screen, I set the width and height also the top & left. So yeah you may ask why we do this and what’s the logic of it, Right? So actually the logic is victim will never understand what will happen to him.

Click on Store and view exploit.

I positioned Test me on Update email. Well so the victim would never understand. For more fooling the victim, we can lower the opacity to 0.0001 instead of 0.1.

Now back to the exploit server change “Test me” to “Click me” and click Store. Click on Deliver exploit to victim.

BOOM! We’ve solved this lab successfully.

Be ready for its other parts 🙂

So Guys welcome to the next topic i.e. Clickjacking, Now as you have started it complete the above topic which is Clickjacking with form input data prefilled from a URL parameter, after completing this topic then move to the next topic i.e. Exploiting Clickjacking Vulnerability To Trigger DOM-Based XSS. Please follow us for more details & Good Luck!

Thank you for reading, if this article really helps you then do share it with your mates. And follow @masaudsec on Twitter.