cross-origin framing

[edent]

On the submission page, I see "iframe injections must contain an iframe with xssposed.org"

If I try to inject [code]<iframe src="http://xssposed.org/"></iframe>[/code]

I get the error.
"Load denied by X-Frame-Options: https://www.xssposed.org/ does not permit cross-origin framing."

Am I missing something? Surely then it is not possible to load an iframe with this site in it.

[x1admin]

you can use iframe, we check request and accept vulnerability

[mradamdavies]

Code: Select all

https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

^Probably blocked to prevent click-jacking, etc.

Try injecting something else, not just another URL.

Probably not vuln.