1. Web Security Academy
  2. Clickjacking
  3. Lab

Lab: Clickjacking with form input data prefilled from a URL parameter


This lab extends the basic clickjacking example in Lab: Basic clickjacking with CSRF token protection. The goal of the lab is to change the email address of the user by prepopulating a form using a URL parameter and enticing the user to click on a "update email" button without the user's knowledge.

To solve the lab, craft some HTML that frames the account page and fools the user into changing their email address by clicking on a "Click me" decoy. The account is solved when the email address is changed.

You have an account on the application that you can use to help design your attack. The credentials are: carlos / montoya.


The victim will be using Chrome so test your exploit on that browser.