# Reverse Tab Nabbing {{#include ../banners/hacktricks-training.md}} ## Description In a situation where an **attacker** can **control** the **`href`** argument of an **` Create the following pages in a folder and run a web server with `python3 -m http.server`\ Then, **access** `http://127.0.0.1:8000/`vulnerable.html, **click** on the link and note how the **original** **website** **URL** **changes**. ```html:vulnerable.html

Victim Site

Controlled by the attacker ``` ```html:malicious.html ``` ```html:malicious_redir.html

New Malicious Site

``` ### Accessible properties In the scenario where a **cross-origin** access occurs (access across different domains), the properties of the **window** JavaScript class instance, referred to by the **opener** JavaScript object reference, that can be accessed by a malicious site are limited to the following: - **`opener.closed`**: This property is accessed to determine if a window has been closed, returning a boolean value. - **`opener.frames`**: This property provides access to all iframe elements within the current window. - **`opener.length`**: The number of iframe elements present in the current window is returned by this property. - **`opener.opener`**: A reference to the window that opened the current window can be obtained through this property. - **`opener.parent`**: This property returns the parent window of the current window. - **`opener.self`**: Access to the current window itself is provided by this property. - **`opener.top`**: This property returns the topmost browser window. However, in instances where the domains are identical, the malicious site gains access to all properties exposed by the [**window**](https://developer.mozilla.org/en-US/docs/Web/API/Window) JavaScript object reference. ## Prevention Prevention information are documented into the [HTML5 Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html#tabnabbing). ## References - [https://owasp.org/www-community/attacks/Reverse_Tabnabbing](https://owasp.org/www-community/attacks/Reverse_Tabnabbing) {{#include ../banners/hacktricks-training.md}}