Find out whether a target website is vulnerable to Reverse Tabnabbing executing 7 lines of code

Here is how you can detect whether a website is vulnerable to Reverse Tabnabbing:

1. Navigate to the target website that you want to scan
2. Open the DevTools and select the Console tab
3. Paste the following JavaScript code into the console and press enter

var anchors = document.querySelectorAll('a[target="_blank"]');
anchors.forEach(anchor => {
  if (anchor.rel.indexOf('noreferrer') === -1 && anchor.rel.indexOf('noopener') === -1) {
    console.log('>>> Found anchor vulnerable to Reverse Tabnabbing: ', anchor);
    anchor.style.border = '2px solid red';
  }
});

Outcome:

All the vulnerable links in the page will be printed out in the console and will also be highlighted in red on the webpage.

Enjoy! =]

---

Example:

• Target website: https://github.com/apache/cordova-android
• Vulnerable anchor: