Reverse Tabnabbing | OWASP Foundation

Reverse Tabnabbing | OWASP Foundation
Reverse Tabnabbing
Thank you for visiting OWASP.org. We have migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done.
This is an example of a Project or Chapter Page.
Update 2023 - this is fixed in modern, evergreen, browsers
Links that use
target="_blank"
now have implicit
rel="noopener"
in
modern browsers, so this vulnerability isn’t as widespread and critical
as before. This implicit rule is also a part of the
HTML standard
According to Caniuse.com evergreen browsers support implicit
rel="noopener"
from about 2018, but there are still some browsers out there that doesn’t support
it, so please consider your userbase when/if deciding to
drop
rel="noopener"
Using
rel="noreferrer"
implies also
rel="noopener"
, so if you have
chosen to use
rel="noreferrer"
, the use of
rel="noopener"
isn’t required.
Description
Reverse tabnabbing is an attack where a page linked from the target page
is able to rewrite that page, for example to replace it with a phishing
site. As the user was originally on the correct page they are less
likely to notice that it has been changed to a phishing site, especially
if the site looks the same as the target. If the user authenticates to
this new page then their credentials (or other sensitive data) are sent
to the phishing site rather than the legitimate one.
As well as the target site being able to overwrite the target page, any
http link can be spoofed to overwrite the target page if the user is on
an unsecured network, for example a public wifi hotspot. The attack is
possible even if the target site is only available via https as the
attacker only needs to spoof the http site that is being linked to.
The attack is typically possible when the source site uses a
target
instruction in a
html link
to specify a
target loading
location
that do not
replace the current location and then let the current window/tab
available and does not include any of the preventative measures detailed
below.
The attack is also possible for link opened via the
window.open
javascript function.
Overview
With back link
Link between parent and child pages when prevention attribute is not
used:
Without back link
Link between parent and child pages when prevention attribute is used:
Examples
Vulnerable page: