1. Navigate to the Home page of the OWASP Mutillidae II.
2. Switch to Burp, and from the top-level menu, select Burp Clickbandit:

3. A pop-up box explains the tool. Click the button entitled Copy Clickbandit to clipboard:

4. Return to the Firefox browser, and press F12 to bring up the developer tools. From the developer tools menu, select Console, and look for the prompt at the bottom:

5. At the Console prompt (for example, >>), paste into the prompt the Clickbandit script you copied to your clipboard:

6. After pasting in the script into the prompt, press the Enter key. You should see the Burp Clickbandit Record mode. Click the Start button to begin:

7. Start clicking around on the application after it appears. Click available links at the top Mutillidae menu, click available links on the side menu, or browse to pages within Mutillidae. Once you've clicked around, press the Finish button on the Burp Clickbandit menu.
8. You should notice big red blocks appear transparently on top of the Mutillidae web pages. Each red block indicates a place where a malicious iframe can appear. Feel free to click each red block to see the next red block appear, and so on:

9. Once you wish to stop and save your results, click the Save button. This will save the Clickjacking PoC in an HTML file for you to place inside your penetration test report.