This lab extends the basic in . The goal of the lab is to change the email address of the user by prepopulating a form using a URL parameter and enticing the user to inadvertently click on an "Update email" button.
To solve the lab, craft some HTML that frames the account page and fools the user into updating their email address by clicking on a "Click me" decoy. The lab is solved when the email address is changed.
You can log in to your own account using the following credentials: wiener:peter
After accessing the lab, I logged in with the provided credentials and searched for the email change functionality. I discovered that a user can change their email by visiting https://0ac60095048f3012818aa7e7008000cc.web-security-academy.net/my-account and filling in the email input field before pressing the "Update email" button.
The challenge in this lab is to submit a pre-filled form because simply tricking the user into clicking the "Update email" button without any input will trigger an error and deny the update. I found that by adding the email parameter to the URL and providing a new value, like so: https://0ac60095048f3012818aa7e7008000cc.web-security-academy.net/my-account?email=ichyaboy@hacking.com, the email field gets pre-filled with the provided value.
I then built my malicious HTML page to exploit this:
This HTML page has two main elements: an iframe and a div. The iframe contains the victim's /my-account page and is set to a relative position in CSS, meaning it remains within the normal document flow. The div, containing the "CLICK ME" text, has an absolute position, meaning it does not affect the layout of other elements and is not affected by them.
When the victim visits this exploit page, they will see only the "CLICK ME" text. Clicking this text, which is not an actual link or button, triggers the underlying "Update email" button in the invisible iframe, which has an opacity of 0.00001, making it virtually invisible to the user. Since the email input is already filled, the form will be successfully submitted, and the email will be changed.
(PS: Use different emails when working on the lab to avoid a "used email" error).
By copying this exploit into the body of the HTML page on the exploit server and delivering it, the lab is solved, confirming the email update of the victim's account.