abelrguezr Reverse Tab Nabbing Security Skill
A skill for identifying, understanding, and preventing reverse tab nabbing vulnerabilities in web applications.
What is Reverse Tab Nabbing?
Reverse tab nabbing is a security vulnerability where an attacker controls the href of an <a> tag with target="_blank" and rel="opener". When a victim clicks the link, the attacker's malicious website gains control over the original page via window.opener, allowing them to:
- Redirect the original page to a phishing site that mimics the legitimate site
- Modify the page content to steal credentials
- Exfiltrate data through JavaScript events
- Perform other stealthy attacks on the original window
When to Use This Skill
Use this skill when:
- Auditing HTML code for security vulnerabilities
- Reviewing link patterns in web applications
- Securing applications that use
target="_blank"links - Investigating potential window.opener attacks
- Creating secure link patterns for web development
- Users mention phishing, link security, or target blank issues
Vulnerable Patterns
Pattern 1: Explicit rel="opener"
<a href="https://attacker.com" target="_blank" rel="opener">Click me</a>
Status: VULNERABLE - Direct window.opener access
Pattern 2: Missing rel attribute with target="_blank"
<a href="https://attacker.com" target="_blank">Click me</a>
Status: VULNERABLE - Modern browsers may still allow opener access
Pattern 3: Incomplete rel attribute
<a href="https://attacker.com" target="_blank" rel="noopener">Click me</a>
Status: PARTIALLY SECURE - Missing noreferrer for referrer protection
Pattern 4: Secure pattern
<a href="https://example.com" target="_blank" rel="noopener noreferrer">Safe link</a>
Status: SECURE - Proper protection against reverse tab nabbing
Detection
Manual Review Checklist
When reviewing HTML code, check for:
- All
<a>tags withtarget="_blank"- These requirerel="noopener noreferrer" - Dynamic link generation - Check JavaScript that creates links programmatically
- Third-party integrations - External links from APIs or user-generated content
- Email templates - HTML emails often have vulnerable link patterns
Automated Scanning
Use the bundled script to scan HTML files:
python scripts/scan_reverse_tab_nabbing.py <path-to-html-files>
The script will:
- Find all anchor tags with
target="_blank" - Identify missing or incomplete
relattributes - Generate a detailed report with line numbers and remediation
Remediation
Fix Vulnerable Links
Before:
<a href="https://external-site.com" target="_blank">Visit Site</a>
After:
<a href="https://external-site.com" target="_blank" rel="noopener noreferrer">Visit Site</a>
Why Both Attributes?
noopener: Prevents the new page from accessingwindow.openernoreferrer: Prevents leaking referrer information to the external site
For JavaScript-Generated Links
// Vulnerable
const link = document.createElement('a');
link.href = externalUrl;
link.target = '_blank';
// Secure
const link = document.createElement('a');
link.href = externalUrl;
link.target = '_blank';
link.rel = 'noopener noreferrer';
Testing the Vulnerability
Create Test Files
To verify your understanding, create these test files:
vulnerable.html:
<!DOCTYPE html>
<html>
<body>
<h1>Victim Site</h1>
<a href="http://127.0.0.1:8000/malicious.html" target="_blank" rel="opener">Controlled by attacker</a>
</body>
</html>
malicious.html:
<!DOCTYPE html>
<html>
<body>
<script>
window.opener.location = "http://127.0.0.1:8000/phishing.html";
</script>
</body>
</html>
phishing.html:
<!DOCTYPE html>
<html>
<body>
<h1>Phishing Site - Looks like original</h1>
<form>
<input type="text" placeholder="Username">
<input type="password" placeholder="Password">
<button>Login</button>
</form>
</body>
</html>
Run with: python3 -m http.server 8000
Access http://127.0.0.1:8000/vulnerable.html and click the link to observe the redirect.
Accessible Properties (Cross-Origin)
When cross-origin access occurs, these window properties are accessible via window.opener:
opener.closed- Boolean indicating if window is closedopener.frames- Access to iframe elementsopener.length- Number of iframe elementsopener.opener- Reference to opening windowopener.parent- Parent window referenceopener.self- Current window referenceopener.top- Topmost browser window
When domains are identical, ALL window properties are accessible.
Prevention Best Practices
- Always use
rel="noopener noreferrer"withtarget="_blank" - Audit existing codebases for vulnerable patterns
- Update CSS frameworks that may generate vulnerable links
- Train developers on this vulnerability
- Include in security reviews as a standard checklist item
- Use linters to catch missing rel attributes