A page that can be framed

Check the headers

The account panel at /app/panel has a sensitive button. Look at its response headers:

curl -s -i http://127.0.0.1:8080/app/panel | head -6

In the terminal

student@vulntech:~$ curl -s -i http://127.0.0.1:8080/app/panel | head -6
HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.11.2
Date: Mon, 19 Oct 2026 08:33:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 154
Connection: close

No X-Frame-Options and no Content-Security-Policy: frame-ancestors. Compare the hardened version, which sets them:

curl -s -i http://127.0.0.1:8080/app/panel-safe | grep -iE 'x-frame-options|content-security'

In the terminal

student@vulntech:~$ curl -s -i http://127.0.0.1:8080/app/panel-safe | grep -iE 'x-frame-options|content-security'
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

Because the panel sets neither, any website is allowed to load it inside a frame — the precondition for clickjacking.