This lab has some account functionality that is protected by a token and also has a confirmation dialog to protect against . To solve this lab construct an attack that fools the user into clicking the delete account button and the confirmation dialog by clicking on "Click me first" and "Click me next" decoy actions. You will need to use two elements for this lab.
You can log in to the account yourself using the following credentials: wiener:peter
After accessing the lab, I logged in with the provided credentials and went straight to the delete functionality at /my-account to understand the process and how to build my exploit.
I noticed that deleting a user requires two steps: first, clicking the "Delete account" button, and second, confirming the deletion. This means I need the user to interact with the page twice.
The idea is to create a webpage that has an invisible iframe containing the victim's /my-account page and two texts. One text will be placed above the "Delete account" button, labeled "Click me first," and the second will be placed above the "Yes" button, responsible for confirming the deletion, labeled "Click me next."
My exploit page looks like this:
This HTML page has three main elements: an iframe and two divs. The iframe contains the /my-account page and is set to a relative position in CSS, meaning it remains within the normal document flow. The divs, containing the "Click me first" and "Click me next" texts, have absolute positions, meaning they do not affect the layout of other elements and are not affected by them. The rest of the CSS places each element in the correct position.
When the victim visits this exploit page, they will see only the "Click me first" text. Clicking this text, which is not an actual link or button, triggers the underlying "Delete Account" button in the invisible iframe, which has an opacity of 0.00001, making it virtually invisible to the user. Then the victim will be asked to confirm the deletion, but they won't see it because the iframe is invisible. At this point, the second div prompts the user to click "Click me next," which actually triggers the "Yes" button to confirm the deletion.
By copying this exploit into the body of the HTML page on the exploit server and delivering it, the lab is solved, confirming the deletion of the Victim's account.