Open Redirect and Reverse Tabnabing PoC

Table of contents

The assessment found Open Redirect and Reverse Tabnabbing vulnerabilities on target.robertquintero.me, posing high-risk threats. These flaws enable phishing and session hijacking. Immediate fixes like URL validation and security headers are recommended.

Assessment Date: February 25, 2025
Target: https://target.robertquintero.me/
Pentester: Robert Quintero

The goal of this penetration test was to identify security vulnerabilities related to Open Redirect and Reverse Tabnabbing and assess their impact on user security.

The target website is vulnerable to Open Redirect and Reverse Tabnabbing, which allow attackers to manipulate user navigation and hijack sessions. Immediate remediation is recommended to prevent phishing, session theft, and user deception.

Vulnerability: Open Redirect
Affected URL: https://target.robertquintero.me/

Steps to Reproduce:

• Navigate to the login page and modify the redirect parameter:
• https://robertquintero.me/login?redirect=https://attacker-site.com
  
• The user is redirected to an attacker-controlled site without validation.

Impact:

• Can be used for phishing attacks.
• Leads to session hijacking by redirecting users to malicious pages.

Vulnerability: Reverse Tabnabbing
Affected Elements: External links opening in new tabs.

Steps to Exploit:

The user clicks on an external link (without rel="noopener" protection), opening a new tab.

In the attacker's new tab, execute the following JavaScript:

window.opener.location = "https://phishing-site.com";

The original tab is hijacked and redirected to a phishing page.

Impact:

• Allows attackers to replace the original site with a fake login page.
• High potential for credential theft.

• Implement URL validation: Only allow redirects to trusted domains.
• Use a whitelist approach for redirect parameters.
• Display a confirmation page before redirecting users.

• Add rel="noopener noreferrer" to all <a target="_blank"> links.
• Enforce Content Security Policy (CSP) to prevent malicious redirections.

✅ Phase 1: Extracts the target URL from the query string.
✅ Phase 2: Opens the target site in a new tab.
✅ Phase 3: Waits to reduce suspicion.
✅ Phase 4: Redirects the new tab to an intermediate phishing page.
✅ Phase 5: Hijacks the original tab to redirect users to a phishing page.

Target: robertquintero.me
PoC: https://or-rt.robertquintero.me/poc.html?target=https://target.robertquintero.me/

This penetration test has identified critical security flaws that could lead to phishing attacks and unauthorized access. Immediate mitigation steps should be taken to prevent exploitation by attackers.

Severity Level: High

✅ Fix the identified vulnerabilities.
✅ Implement security headers (CSP, Referrer-Policy).
✅ Conduct further security assessments to uncover additional risks.