Course 38 - Web Security Known Web Attacks | Episode 4: From Phishing to Reverse Clickjacking

In this lesson, you’ll learn about: window.opener risks, phishing via tab manipulation, and Same Origin Method Execution (SOME)1. What is window.openerUsing JavaScript:🔹 Definition:A property that gives a newly opened tab access to its parent tab🔹 When it exists:When a link uses target="_blank"👉 Key InsightA child tab can control or modify the parent tab2. Why window.opener is Dangerous🔹 Core issue:Trust between tabs is implicit🔹 Risk:The new tab may be malicious or compromised👉 Key InsightOpening external links creates a hidden trust boundary3. Phishing via window.opener🔹 Attack flow:User clicks link on trusted siteNew tab opens (attacker-controlled)Attacker uses window.openerParent tab is redirected to fake login page👉 Key InsightUser thinks they’re still on the trusted site4. Why This Phishing Works🔹 Psychological factor:User trusts the original tab🔹 Technical factor:URL changes silently in background👉 Key InsightThis attack combines technical manipulation + human trust5. Same Origin Method Execution (SOME)🔹 Definition:Triggering actions in another window using limited scripting capabilities🔹 Also known as:Reverse clickjacking👉 Key InsightEven without full XSS, attackers can still execute actions indirectly6. How SOME Works🔹 Core idea:Child tab keeps reference to parentWaits for parent to reach sensitive stateTriggers actions programmatically👉 Key InsightTiming + reference = powerful attack vector7. Weak Callback Exploitation🔹 Targets:JSONP endpointsLegacy browser integrations🔹 Why they matter:Accept limited charactersStill allow function execution👉 Key InsightEven restricted inputs can be abused for execution8. Example Impact of SOME🔹 Possible actions:Trigger button clicksSubmit formsPerform sensitive operations👉 Key InsightUser doesn’t need to interact—actions happen silently9. Relation to Other Attacks🔹 Similar to:Cross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)🔹 Difference:Uses browser relationships instead of direct injection👉 Key InsightSOME is a bypass technique when XSS/CSRF are blocked10. Preventing window.opener Attacks🔹 Best practices:Add rel="noopener noreferrer" to linksAvoid unnecessary target="_blank"Use strict Content Security Policy (CSP)👉 Key InsightYou must explicitly break the opener relationship11. Defense Against SOME🔹 Strategies:Avoid JSONP and legacy callbacksValidate all actions server-sideImplement CSRF protections👉 Key InsightNever rely on client-side trust12. Big Security Lesson🔹 Core idea:Browser features can be weaponized🔹 Reality:Even “normal” functionality can become an attack vector👉 Key InsightSecurity requires understanding how features interact, not just codeKey Takeawayswindow.opener allows child tabs to control parent tabsCan be used for stealth phishing attacksSOME enables action execution without full XSSLegacy features increase riskProper link attributes and validation are criticalBig PictureYou are learning:👉 How browser tab relationships create vulnerabilities👉 How attackers exploit trust and timing👉 How modern defenses evolved from these weaknessesMental ModelUser click → new tab → opener reference → parent manipulation → exploitationYou can listen and download our episodes for free on more than 10 different platforms:https://linktr.ee/cybercode_academy