The following steps will guide you to uncover clickjacking using the Burp Suite Clickbandit:
- To uncover clickjacking requests, we will first want to look at Burp Suite Scanner as it identifies pages potentially vulnerable to clickjacking. These pages are identified with an issue type of Frameable response (potential Clickjacking). In this case, the following page may be vulnerable (http://172.16.69.128/mutillidae/framing.php):
- After selecting the issue in question, we go up to the Burp menu and select Burp Clickbandit, as depicted in the following screenshot:
- Burp will present us with a screen describing what to do and a button, Copy Clickbandit to clipboard. Click on it:
- Next, we go to our browser and navigate to the potentially vulnerable page (http://172.16.69.128/mutillidae/framing.php):
- From the browser, we need to open the developer console from the menu and select the web console:
- At the bottom of the page, we then paste in our Clickbandit code we copied before and hit the Enter key:
- Clickbandit frames our potentially vulnerable page. After clicking inside the page, we can see that it is in fact performing a clickjacking attack:
