Exploiting clickjacking vulnerability to trigger DOM-based XSS | Practitioner

Wed, 08 Jul 2026 13:46:16 +0800

As the lab’s name suggests, there exists a DOM-XSS vulnerability somewhere in the application. Naturally, we should crawl through the site and see where does a vulnerable DOM sink lives. The feedback form is looking a bit fishy so let’s check that out! Looks like our intuition is correct! Whatever passed into the name field will be reflected in the innerHTML sink after submission. And it looks like the application doesn’t filter out angle brackets or quotes, which makes constructing XSS payloads much easier. Let’s test this out by injecting a harmless h1: The parser indeed recognises this as valid HTML, and display it proudly. Since our sink is innerHTML, we have to use img or iframe to fire our events. Testing with the <img src=1 onerror=print()> payload will do its job as told.

Clickjacking with a frame buster script | Apprentice

Wed, 08 Jul 2026 10:18:16 +0800

First of all, in order for a clickjacking attempt that changes victim’s states to work, anything that requires cookie auth must have that cookie set SameSite=None. Thankfully, this is indeed the case for this lab: Upon checking the source code, we can see that the developer tries to prevent clickjacking by adding a frame busting script as shown here. What this does is that it checks if the top-most window is the same as the current window. If they are different, it means the page is inside an iframe and the attempt is blocked: If we try to use Burp Clickbandit, notice that the attempt to frame the site is blocked: To solve this, we should also strip allow-scripts so that the framed page’s JavaScript will be blocked. allow-forms is still kept because we need a form to change emails with (lol) After that, use Clickbandit to generate a sample PoC and deliver it to the victim. Neat

Clickjacking on an's security blog

Exploiting clickjacking vulnerability to trigger DOM-based XSS | Practitioner

Clickjacking with a frame buster script | Apprentice