Web Security & OWASP (50 Qs)•Part 4: Browser Security, HTTP Headers & Client Hardening (36 - 42)
Tabnabbing & Reverse Tabnabbing: Exploiting window.opener in target="_blank" links and the rel fix.
How Reverse Tabnabbing Works
When you open an external link using <a href="https://untrusted.com" target="_blank">, the browser opens the page in a new tab. By default in older browsers, the newly opened page retains a reference to the referring window via the JavaScript property window.opener.
sql
1. User is on https://mybank.com and clicks an external link to https://evil.com.
2. In the new tab, evil.com executes:
if (window.opener) {
window.opener.location = "https://phishing-bank.com/login-expired";
}
3. The user reads evil.com, then returns to their original tab.
4. The original tab now displays an exact replica of the bank's login page!
5. Thinking their session timed out, the victim re-enters their credentials!
The Fix: rel="noopener noreferrer"
html
<!-- SECURE: Sets window.opener to null and strips the Referer header -->
<a href="https://external.com" target="_blank" rel="noopener noreferrer">
Visit Partner
</a>
Modern browsers (Chrome 88+, Firefox 79+, Safari 12+) automatically default target="_blank" to rel="noopener", but explicitly declaring rel="noopener noreferrer" remains a strict enterprise compliance requirement.