Lab: Exploiting clickjacking vulnerability to trigger DOM-based XSS
Summary: PortSwigger's Web Security Academy lab describes an XSS vulnerability triggered by a click, in which an attacker builds a clickjacking page that overlays a transparent iframe of the target's "Submit feedback" page under a decoy "Click me" button. The exploit passes a payload in the feedback form's name parameter - <img src=1 onerror=print()> - so that a victim's click calls the print() function, with the lab noting the victim uses Chrome.
Why it matters: The attack needs no code execution on the victim's machine: a single click on a decoy button, with the iframe set to an opacity of 0.0001, is enough to fire the injected payload - which is why clickjacking and DOM-based XSS are treated as a combined risk rather than two separate ones.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026