Skip to main content
This page aggregates cross-platform resources to practice Clickjacking: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills. Coverage: 5 challenges across 1 platform β€” 5 PortSwigger. 0 with a Spanish writeup, 0 with a video writeup.

​
Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.
  1. PortSwigger β€” Basic clickjacking with CSRF token protection (Apprentice) Β· πŸ‡¬πŸ‡§
  2. PortSwigger β€” Clickjacking with a frame buster script (Apprentice) Β· πŸ‡¬πŸ‡§
  3. PortSwigger β€” Clickjacking with form input data prefilled from a URL parameter (Apprentice) Β· πŸ‡¬πŸ‡§
  4. PortSwigger β€” Exploiting clickjacking vulnerability to trigger DOM-based XSS (Practitioner) Β· πŸ‡¬πŸ‡§
  5. PortSwigger β€” Multistep clickjacking (Practitioner) Β· πŸ‡¬πŸ‡§

​
Curated resources

​
PortSwigger labs practicing Clickjacking (5)

← Back to the full glossary Last updated: 2026-08-13