This lab is protected by a frame buster which prevents the website from being framed. Can you get around the frame buster and conduct a that changes the users email address?
To solve the lab, craft some HTML that frames the account page and fools the user into changing their email address by clicking on "Click me". The lab is solved when the email address is changed.
You can log in to your own account using the following credentials: wiener:peter
After accessing the lab, I logged in with the provided credentials and searched for the email change functionality. I discovered that a user can change their email by visiting https://0a1600a7035537af8266833d00bd000c.web-security-academy.net/my-account and filling in the email input field before pressing the "Update email" button.
The challenge in this lab is to submit a pre-filled form because simply tricking the user into clicking the "Update email" button without any input will trigger an error and deny the update. I found that by adding the email parameter to the URL and providing a new value, like so: https://0ac60095048f3012818aa7e7008000cc.web-security-academy.net/my-account?email=ichyaboy@hacking.com, the email field gets pre-filled with the provided value.
Despite this, the exploit won't work because this lab is protected by a frame buster, which prevents websites from being framed. To bypass this, I used the HTML5 iframe sandbox attribute. By passing allow-forms or allow-scripts as a value, the frame buster script is neutralized.
My exploit page is as follows:\
This HTML page has two main elements: an iframe and a div. The iframe contains the victim's /my-account page and is set to a relative position in CSS, meaning it remains within the normal document flow. The div, containing the "CLICK ME" text, has an absolute position, meaning it does not affect the layout of other elements and is not affected by them.
When the victim visits this exploit page, they will see only the "CLICK ME" text. Clicking this text, which is not an actual link or button, triggers the underlying "Update email" button in the invisible iframe, which has an opacity of 0.1, making it virtually invisible to the user. Since the email input is already filled, the form will be successfully submitted, and the email will be changed.
(PS: Use different emails when working on the lab to avoid a "used email" error).
By copying this exploit into the body of the HTML page on the exploit server and delivering it, the lab is solved, confirming the email update of the victim's account.