hacktricks/pentesting-web/reverse-tab-nabbing.md

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}


# Maelezo

Katika hali ambapo **mshambuliaji** anaweza **kudhibiti** **`href`** ya **`<a`** tag yenye sifa **`target="_blank" rel="opener"`** ambayo itabonyezwa na mwathirika, **mshambuliaji** **anapoint** **kiungo** hiki kwenye wavuti chini ya udhibiti wake (**tovuti** **mbaya**). Kisha, mara tu **mwathirika anapobonyeza** kiungo na kufikia tovuti ya mshambuliaji, **tovuti** hii **mbaya** itakuwa na uwezo wa **kudhibiti** **ukurasa** **wa asili** kupitia kitu cha javascript **`window.opener`**.\
Ikiwa ukurasa huna **`rel="opener"` lakini ina `target="_blank"` na pia haina `rel="noopener"`** inaweza pia kuwa na hatari.

Njia ya kawaida ya kutumia tabia hii ni **kubadilisha eneo la wavuti ya asili** kupitia `window.opener.location = https://attacker.com/victim.html` kwa wavuti inayodhibitiwa na mshambuliaji ambayo **inafanana na ile ya asili**, ili iweze **kuiga** **fomu ya kuingia** ya tovuti ya asili na kuomba taarifa za kuingia kwa mtumiaji.

Hata hivyo, kumbuka kwamba sasa **mshambuliaji anaweza kudhibiti kitu cha dirisha cha tovuti ya asili** anaweza kuitumia vibaya kwa njia nyingine ili kutekeleza **shambulio la siri** (labda kubadilisha matukio ya javascript ili kuhamasisha taarifa kwa seva inayodhibitiwa na yeye?)

# Muhtasari

## Pamoja na kiungo cha nyuma

Kiungo kati ya kurasa za mzazi na mtoto wakati sifa ya kuzuia haitumiki:

![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITH_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITH\_LINK.png)

## Bila kiungo cha nyuma

Kiungo kati ya kurasa za mzazi na mtoto wakati sifa ya kuzuia inatumika:

![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITHOUT_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITHOUT\_LINK.png)

## Mifano <a href="#examples" id="examples"></a>

Unda kurasa zifuatazo katika folda na endesha seva ya wavuti kwa `python3 -m http.server`\
Kisha, **fikia** `http://127.0.0.1:8000/`vulnerable.html, **bonyeza** kwenye kiungo na uone jinsi **URL** ya **tovuti** **ya asili** **inavyobadilika**.

{% code title="vulnerable.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<h1>Victim Site</h1>
<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by the attacker</a>
</body>
</html>
```
{% endcode %}

{% code title="malicious.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<script>
window.opener.location = "http://127.0.0.1:8000/malicious_redir.html";
</script>
</body>
</html>
```
{% endcode %}

{% code title="malicious_redir.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<h1>New Malicious Site</h1>
</body>
</html>
```
{% endcode %}

## Mali ya kupatikana <a href="#accessible-properties" id="accessible-properties"></a>

Katika hali ambapo **upatikanaji wa cross-origin** unafanyika (upatikanaji kati ya maeneo tofauti), mali za mfano wa darasa la JavaScript la **window**, zinazorejelewa na kiashiria cha kitu cha JavaScript cha **opener**, ambazo zinaweza kupatikana na tovuti mbaya zimepunguzwa kwa yafuatayo:

- **`opener.closed`**: Mali hii inapatikana ili kubaini kama dirisha limefungwa, ikirudisha thamani ya boolean.
- **`opener.frames`**: Mali hii inatoa upatikanaji wa vipengele vyote vya iframe ndani ya dirisha la sasa.
- **`opener.length`**: Idadi ya vipengele vya iframe vilivyopo katika dirisha la sasa inarudishwa na mali hii.
- **`opener.opener`**: Kiashiria kwa dirisha lililofungua dirisha la sasa linaweza kupatikana kupitia mali hii.
- **`opener.parent`**: Mali hii inarudisha dirisha la mzazi la dirisha la sasa.
- **`opener.self`**: Upatikanaji wa dirisha la sasa lenyewe unapatikana kupitia mali hii.
- **`opener.top`**: Mali hii inarudisha dirisha la kivinjari lililo juu kabisa.

Hata hivyo, katika matukio ambapo maeneo ni sawa, tovuti mbaya inapata upatikanaji wa mali zote zilizofichuliwa na kiashiria cha [**window**](https://developer.mozilla.org/en-US/docs/Web/API/Window) cha JavaScript.

# Kuzuia

Taarifa za kuzuia zimeandikwa katika [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security\_Cheat\_Sheet.html#tabnabbing).

## Marejeleo

* [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing)

{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)

<details>

<summary>Support HackTricks</summary>

* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

</details>
{% endhint %}
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`<details>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`<summary>Support HackTricks</summary>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`{% endhint %}`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00

Translated to Swahili 2024-02-11 02:13:58 +00:00			`# Maelezo`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			Katika hali ambapo mshambuliaji anaweza kudhibiti `href` ya `<a` tag yenye sifa `target="_blank" rel="opener"` ambayo itabonyezwa na mwathirika, mshambuliaji anapoint kiungo hiki kwenye wavuti chini ya udhibiti wake (tovuti mbaya). Kisha, mara tu mwathirika anapobonyeza kiungo na kufikia tovuti ya mshambuliaji, tovuti hii mbaya itakuwa na uwezo wa kudhibiti ukurasa wa asili kupitia kitu cha javascript `window.opener`.\
			Ikiwa ukurasa huna `rel="opener"` lakini ina `target="_blank"` na pia haina `rel="noopener"` inaweza pia kuwa na hatari.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			Njia ya kawaida ya kutumia tabia hii ni kubadilisha eneo la wavuti ya asili kupitia `window.opener.location = https://attacker.com/victim.html` kwa wavuti inayodhibitiwa na mshambuliaji ambayo inafanana na ile ya asili, ili iweze kuiga fomu ya kuingia ya tovuti ya asili na kuomba taarifa za kuingia kwa mtumiaji.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`Hata hivyo, kumbuka kwamba sasa mshambuliaji anaweza kudhibiti kitu cha dirisha cha tovuti ya asili anaweza kuitumia vibaya kwa njia nyingine ili kutekeleza shambulio la siri (labda kubadilisha matukio ya javascript ili kuhamasisha taarifa kwa seva inayodhibitiwa na yeye?)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`# Muhtasari`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`## Pamoja na kiungo cha nyuma`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`Kiungo kati ya kurasa za mzazi na mtoto wakati sifa ya kuzuia haitumiki:`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
a 2024-02-06 04:10:38 +01:00			`![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITH_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITH\_LINK.png)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`## Bila kiungo cha nyuma`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`Kiungo kati ya kurasa za mzazi na mtoto wakati sifa ya kuzuia inatumika:`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
a 2024-02-06 04:10:38 +01:00			`![https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITHOUT_LINK.png](https://owasp.org/www-community/assets/images/TABNABBING\_OVERVIEW\_WITHOUT\_LINK.png)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`## Mifano <a href="#examples" id="examples"></a>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			Unda kurasa zifuatazo katika folda na endesha seva ya wavuti kwa `python3 -m http.server`\
			Kisha, fikia `http://127.0.0.1:8000/`vulnerable.html, bonyeza kwenye kiungo na uone jinsi URL ya tovuti ya asili inavyobadilika.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			`{% code title="vulnerable.html" %}`
			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<h1>Victim Site</h1>`
			`<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by the attacker</a>`
			`</body>`
			`</html>`
			```
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`{% endcode %}`

GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			`{% code title="malicious.html" %}`
			```markup
			`<!DOCTYPE html>`
			`<html>`
Translated to Swahili 2024-02-11 02:13:58 +00:00			`<body>`
			`<script>`
			`window.opener.location = "http://127.0.0.1:8000/malicious_redir.html";`
			`</script>`
			`</body>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			`</html>`
			```
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`{% endcode %}`

GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`{% code title="malicious_redir.html" %}`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<h1>New Malicious Site</h1>`
			`</body>`
			`</html>`
			```
			`{% endcode %}`

Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`## Mali ya kupatikana <a href="#accessible-properties" id="accessible-properties"></a>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`Katika hali ambapo upatikanaji wa cross-origin unafanyika (upatikanaji kati ya maeneo tofauti), mali za mfano wa darasa la JavaScript la window, zinazorejelewa na kiashiria cha kitu cha JavaScript cha opener, ambazo zinaweza kupatikana na tovuti mbaya zimepunguzwa kwa yafuatayo:`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			- `opener.closed`: Mali hii inapatikana ili kubaini kama dirisha limefungwa, ikirudisha thamani ya boolean.
			- `opener.frames`: Mali hii inatoa upatikanaji wa vipengele vyote vya iframe ndani ya dirisha la sasa.
Translated to Swahili 2024-02-11 02:13:58 +00:00			- `opener.length`: Idadi ya vipengele vya iframe vilivyopo katika dirisha la sasa inarudishwa na mali hii.
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			- `opener.opener`: Kiashiria kwa dirisha lililofungua dirisha la sasa linaweza kupatikana kupitia mali hii.
			- `opener.parent`: Mali hii inarudisha dirisha la mzazi la dirisha la sasa.
			- `opener.self`: Upatikanaji wa dirisha la sasa lenyewe unapatikana kupitia mali hii.
			- `opener.top`: Mali hii inarudisha dirisha la kivinjari lililo juu kabisa.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`Hata hivyo, katika matukio ambapo maeneo ni sawa, tovuti mbaya inapata upatikanaji wa mali zote zilizofichuliwa na kiashiria cha [window](https://developer.mozilla.org/en-US/docs/Web/API/Window) cha JavaScript.`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated to Swahili 2024-02-11 02:13:58 +00:00			`# Kuzuia`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`Taarifa za kuzuia zimeandikwa katika [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security\_Cheat\_Sheet.html#tabnabbing).`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`## Marejeleo`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
a 2024-02-06 04:10:38 +01:00			`* [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`{% hint style="success" %}`
			`Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[HackTricks Training AWS Red Team Expert (ARTE)](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\`
			`Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[HackTricks Training GCP Red Team Expert (GRTE)<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`<details>`

Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`<summary>Support HackTricks</summary>`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`* Check the [subscription plans](https://github.com/sponsors/carlospolop)!`
			`* Join the 💬 [Discord group](https://discord.gg/hRep4RUj7f) or the [telegram group](https://t.me/peass) or follow us on Twitter 🐦 [@hacktricks\_live](https://twitter.com/hacktricks\_live).`
			`* Share hacking tricks by submitting PRs to the [HackTricks](https://github.com/carlospolop/hacktricks) and [HackTricks Cloud](https://github.com/carlospolop/hacktricks-cloud) github repos.`
Ad hacktricks sponsoring 2022-04-28 16:01:33 +00:00
			`</details>`
Translated ['generic-methodologies-and-resources/basic-forensic-methodol 2024-07-19 10:17:18 +00:00			`{% endhint %}`