Basic clickjacking with CSRF token protection (Video solution)

This video shows the lab solution of "Basic clickjacking with CSRF token protection" from Web Security Academy (Portswigger)

[amrfh]

the iframe tag is pointing to the lab id, how could this lead to delete the account ?!
shouldnt it be leading to labid/account/delete ?

[anujjain]

The above solution has only one button (delete) so the top position value might not work when you have an update email button also. Just inspect the element and notice the button (delete account) and note the position from the top. I got it approx 500 px.
A solution that I tried and works with 2021 version:
<style>
iframe {
position:relative;
width: 500px;
height: 700px;
opacity: 0.0001;
z-index: 2;
}
div {
position:absolute;
top: 500px;
left: 60px;
z-index: 1;
}
</style>
<div>Click me</div>
<iframe

Happy Learning!

[t]

it's working on me but the lab isn't accepting the answer

[aishwaryabochageri]

Whats the carlos password which u gave in intital login step..?

[harshitasingh]

can you just post a video of 2021 version because it has some updates and this is not working

[ianporter]

I may have deleted the account before finishing the lab...any way to log in with someone else or reset the lab?