Lab: Clickjacking with a frame buster script
Summary: PortSwigger's lab presents a website protected by a frame buster script that prevents the page from being framed, and asks the solver to get around it and conduct a clickjacking attack that changes a user's email address. The task is to craft HTML that frames the account page and tricks the user into clicking "Click me" to change the email, using the credentials wiener:peter and testing on Chrome.
What you should know: A frame buster is a common, low-effort defense that many teams treat as sufficient against clickjacking, and this lab exists because it can be bypassed to make a victim change their own account email.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026