3

I just learn about tabnabbing.

Tabnabbing is a computer exploit and phishing attack, which persuades users to submit their login details and passwords to popular websites by impersonating those sites and convincing the user that the site is genuine. [...] The exploit employs scripts to rewrite a page of average interest with an impersonation of a well-known website, when left unattended for some time.

It is mentionned that you can detect to which website a user is currently logged in.

How would you proceed to detect is logged in Facebook from another site for example?

Improve this question

1 Answer 1

Reset to default
3

There is no universal standard about what "being logged in" actually means, so there is no universally applicable solution.

Depending on the website, the attacker could use a javascript which attempts to load an image or other media file from the external website which can only be requested by a user which is logged in. When the user is logged in, the load event will be triggered, otherwise the error event will be triggered.

Improve this answer
2
  • 1
    Unless hosted under the same domain, the SOP will scratch this.
    – marstato
    Jul 3, 2014 at 14:29
  • @marstato You can embed an image from a different domain. There is no browser-sided SOP check for that (the server can check the Referer header, which some server do to prevent hotlinking, but it is not particularly common). The browser will behave differently depending on whether loading the image is successful or not. More information: developer.mozilla.org/en-US/docs/Web/Security/…
    – Philipp
    Apr 8, 2015 at 12:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .