htARTE (HackTricks AWS Red Team Expert) ! Learn AWS hacking from zero to hero with

Other ways to support HackTricks: * If you want to see your **company advertised in HackTricks** or **download HackTricks in PDF** Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! * Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) * **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.** * **Share your hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.

# Description In a situation where an **attacker** can **control** the **`href`** argument of an **` Create the following pages in a folder and run a web server with `python3 -m http.server`\ Then, **access** `http://127.0.0.1:8000/`vulnerable.html, **click** on the link and note how the **original** **website** **URL** **changes**. {% code title="vulnerable.html" %} ```markup

Victim Site

Controlled by the attacker ``` {% code title="malicious.html" %} ```markup ``` {% code title="malicious_redir.html" %} ```markup

New Malicious Site

``` {% endcode %} ## QaQHa' Qapla' DaH jatlh **cross-origin** access vItlhutlh (vItlhutlh qetlh), **window** JavaScript class instance, **opener** JavaScript object reference, **malicious site** vItlhutlh 'e' vItlhutlh **accessible properties**: - **`opener.closed`**: vItlhutlh 'e' vItlhutlh window vItlhutlh, boolean value vItlhutlh. - **`opener.frames`**: vItlhutlh 'e' vItlhutlh iframe elements vItlhutlh current window. - **`opener.length`**: vItlhutlh 'e' vItlhutlh iframe elements vItlhutlh current window. - **`opener.opener`**: vItlhutlh 'e' vItlhutlh window vItlhutlh opened current window. - **`opener.parent`**: vItlhutlh 'e' vItlhutlh parent window vItlhutlh current window. - **`opener.self`**: vItlhutlh 'e' vItlhutlh current window vItlhutlh. - **`opener.top`**: vItlhutlh 'e' vItlhutlh topmost browser window. 'ach, vItlhutlh 'e' domains vItlhutlh identical, **malicious site** vItlhutlh 'e' vItlhutlh **properties** exposed [**window**](https://developer.mozilla.org/en-US/docs/Web/API/Window) JavaScript object reference. # Qap Qap information documented [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security\_Cheat\_Sheet.html#tabnabbing). ## References * [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing)

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!