Attacks & Threats
Tabnabbing
Also known as: Reverse tabnabbing
Definition
An attack where a background or newly opened browser tab silently rewrites itself to look like a trusted login page, hoping the user returns and re-enters credentials.
Examples
- A tab the user left open quietly rewrites itself to resemble Gmail's login page and prompts for a password.
- A link in a comment opens a new tab and uses window.opener to redirect the user's original tab to a phishing site.
Related terms
Clickjacking
A UI-redress attack that tricks users into clicking on something different from what they perceive by overlaying or hiding a target page inside an attacker-controlled page.
Phishing
A social-engineering attack in which an attacker impersonates a trusted party to trick a victim into revealing credentials, transferring money, or running malware.
Open Redirect
Open Redirect — definition coming soon.
Cross-Site Scripting (XSS)
A web vulnerability that allows attackers to inject malicious scripts into pages viewed by other users, executing in the victim's browser under the site's origin.
Content Security Policy (CSP)
Content Security Policy (CSP) — definition coming soon.
Watering Hole Attack
A targeted attack that compromises a website frequently visited by a specific group of users in order to infect them when they browse it.