Discover Reverse Tabnabbing
Summary: Reverse tabnabbing is an attack in which a page linked from the target page can rewrite that page, for example replacing it with a phishing site, and users are less likely to notice because they started on the correct page. The source describes a Burp extension called Discovering Reverse Tabnabbing, written in Python by author GabsJahBless, version 1.0, last updated 06 December 2019, which locates HTML links using the target="_blank" attribute that omit rel="noopener".
What you should know: Any link on your site that opens with target="_blank" and lacks rel="noopener" hands the linked page the ability to swap your page for a phishing site, and credentials entered there go to the attacker rather than to you.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026