Tabnabbing

When you open a link in a new tab ( target="_blank" ), the page that opens in a new tab can access the initial tab and change it's location using the window.opener property.

Detection

<a href="..." target="_blank" rel="" />  

<a href="..." target="_blank" />

HackerOne disclosed on HackerOne: Tab nabbing in Hackerone inbox.HackerOne

Legal Robot disclosed on HackerOne: TabNabbing issue (due to...HackerOne

GitHub - molnarg/tabnabbing-demo: Tabnabbing demo.GitHub

What Is Tabnabbing and How It WorksEasyDMARC

Interesting Books

Interesting Books

Disclaimer: As an Amazon Associate, I earn from qualifying purchases. This helps support this GitBook project at no extra cost to you.

• The Web Application Hacker’s Handbook The go-to manual for web app pentesters. Covers XSS, SQLi, logic flaws, and more

• Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities Learn how to perform reconnaissance on a target, how to identify vulnerabilities, and how to exploit them

• Real-World Bug Hunting: A Field Guide to Web Hacking Learn about the most common types of bugs like cross-site scripting, insecure direct object references, and server-side request forgery.