skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-reverse-tab-nabbing

Detects and exploits reverse tabnabbing via target="_blank" links lacking rel="noopener".

954|172|Updated Mar 13, 2026
Search Tags:#owasp#penetration testing#web security#client-side#phishing#reverse tabnabbing#window.opener
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill exploiting-reverse-tab-nabbing
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-reverse-tab-nabbing
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/web-application-security/exploiting-reverse-tab-nabbing
Command: npx skills add https://github.com/xalgord/xalgorix --skill exploiting-reverse-tab-nabbing

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Web applications that render user-controllable links with target="_blank" but without rel="noopener" expose users to reverse tabnabbing, where an attacker-controlled page silently redirects the victim's original tab to a phishing clone. This Skill guides testers through identifying, confirming, and demonstrating this client-side vulnerability during authorized assessments.

Core Features & Use Cases

  • Vulnerable Link Detection: Locate target="_blank" anchors and window.open() calls missing rel="noopener" or explicitly using rel="opener" in rendered HTML and client-side JavaScript.
  • Exploitation Workflow: Host a hijack page that uses window.opener.location to redirect the original tab, build a credential-harvesting clone, and deliver the link through profiles, comments, or support tickets.
  • Impact Confirmation: Verify window.opener is non-null, observe the original tab navigate to the clone, and distinguish cross-origin versus same-origin opener access to avoid false negatives.
  • Use Case: During a pentest of a social platform, you find profile website links rendered with target="_blank" rel="opener"; you set your profile URL to a hijack page and demonstrate that any viewer who clicks it has their original tab swapped to a fake login page.

Quick Start

Review the target application's rendered HTML for target="_blank" links lacking rel="noopener", then follow the workflow to host a hijack page and confirm the original tab redirects to a phishing clone.

Frequently Asked Questions about exploiting-reverse-tab-nabbing

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for reverse tabnabbing vulnerabilities?▼

Search rendered HTML for target="_blank" anchors missing rel="noopener" or using rel="opener", and check client JavaScript for window.open() calls. Then host a page that sets window.opener.location and confirm the original tab navigates to your clone after a victim clicks the link.

What link attributes prevent reverse tabnabbing?▼

Adding rel="noopener" or rel="noreferrer" to target="_blank" links severs the window.opener reference and prevents the attack. The vulnerable combinations are rel="opener", a missing rel attribute on older browsers, and window.open() calls that are not covered by modern anchor defaults.

Does rel="noopener" matter in modern browsers?▼

Modern browsers default target="_blank" anchors to noopener, but rel="opener" explicitly re-enables the vulnerability and window.open() is not covered by that default. Older browsers and embedded webviews may also still leak the opener reference.

How do I confirm a reverse tabnabbing finding is real?▼

Verify window.opener is non-null on the attacker page and that setting window.opener.location actually changes the original tab's URL. Reproduce locally with python3 -m http.server and show the redirect lands on a credential-harvesting clone rendered to other users.

What is the difference between cross-origin and same-origin opener access?▼

Cross-origin opener access is limited but still allows navigating the original tab via window.opener.location, which is enough for phishing. Same-origin opener access grants the attacker page the full window object of the original page, enabling deeper manipulation and data access.

Related Skills

Explore More Software Engineering Skills→
RyoMa99RyoMa99

katana-links

Enumerate hyperlinks from a target URL into a clipboard-ready list.

Community
Intermediate
wgpsecwgpsec
1.6k

report-generate

Generate structured penetration testing reports with CVSS risk ratings and remediation guidance.

Official
Intermediate
zebbernzebbern
34

Phishing Attacks

Guide phishing attack simulations using Shellphish and Wifiphisher for penetration testing.

Community
Advanced
sixscripts-aisixscripts-ai

SQL Injection Testing

Identify and demonstrate SQL injection vulnerabilities across MySQL, MSSQL, PostgreSQL, and Oracle.

Community
Advanced