wstg-clnt-14

name	wstg-clnt-14
description	Testing for Reverse Tabnabbing
category	client-side
owasp_id	WSTG-CLNT-14
version	1.0.0
author	cyberstrike-official
tags	["client-side","javascript","dom","cors","wstg","clnt"]
tech_stack	[]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

wstg-clnt-14

Test ID

WSTG-CLNT-14

Test Name

Testing for Reverse Tabnabbing

High-Level Description

Reverse Tabnabbing is a phishing attack where a malicious page opened via target="_blank" can modify the opener page's location through window.opener. This can redirect users to a phishing page while they believe they're still on the original site.

---

What to Check

• Links with target="_blank"
• rel="noopener noreferrer" attribute
• window.open() calls without noopener
• User-generated links
• Dynamic link creation

---

How to Test

Step 1: Identify Vulnerable Links

#!/bin/bash
TARGET="https://target.com"

# Find links with target="_blank"
echo "[*] Finding target=_blank links..."

curl -s "$TARGET" | grep -oP '<a[^>]*target=["\']_blank["\'][^>]*>' | while read -r link; do
    echo "Link: $link"

    if ! echo "$link" | grep -qi 'rel="[^"]*noopener'; then
        echo "  [!] Missing noopener"
    fi

    if ! echo "$link" | grep -qi 'rel="[^"]*noreferrer'; then
        echo "  [!] Missing noreferrer"
    fi
done

Step 2: Reverse Tabnabbing Tester

#!/usr/bin/env python3
"""
Reverse Tabnabbing Vulnerability Tester
"""

import requests
import re
from bs4 import BeautifulSoup
 urllib.parse  urljoin

 :
     ():
        .url = url
        .findings = []

     ():
        
        ()
        response = requests.get(.url)
         response.text

     ():
        
        ()

        soup = BeautifulSoup(html, )

        
        blank_links = soup.find_all(, target=)

         link  blank_links:
            href = link.get(, )
            rel = link.get(, [])

            
             (rel, ):
                rel = rel.split()

            has_noopener =   rel
            has_noreferrer =   rel

              has_noopener:
                ()
                .findings.append({
                    : ,
                    : href,
                    : ,
                    : (link)[:]
                })

              has_noreferrer:
                ()

     ():
        
        ()

        
        window_open_pattern = 
        matches = re.findall(window_open_pattern, html)

           matches:
            
                .lower():
                ()
                .findings.append({
                    : ,
                    : ,
                    : 
                })

     ():
        
        ()

        
        patterns = [
            (,
             ),
            (,
             ),
            (,
             ),
        ]

         pattern, description  patterns:
             re.search(pattern, html, re.IGNORECASE):
                ()

     ():
        
        poc = 
         poc

     ():
        
        test_page = 
         test_page

     ():
        
        html = .fetch_page()

        .analyze_links(html)
        .analyze_javascript(html)
        .analyze_dynamic_links(html)

        .generate_report()

     ():
        
        ( + *)
        ()
        (*)

          .findings:
            ()
            ()
        :
            ()

             f  .findings:
                ()
                   f:
                    ()
                   f:
                    ()
                ()

            ()
            (.generate_poc(.url))


tester = TabnabbingTester()
tester.run_tests()