133

Wikipedia is not very explicit on this,

The exploit employs scripts to rewrite a page of average interest with an impersonation of a well-known website, when left unattended for some time.

What is 'tabnabbing', how does one do it?

168

Tabnabbing is a phishing technique where a malicious web site changes its looks while the tab is inactive in order to trick the user into entering credentials.

This page is simultaneously a description and a demo. When you visit it, it shows a description of what tabnabbing is. When you then click another tab, it changes the tabs favicon and title to look like Gmail. Later, when the user wants to read her mail she goes to this tab thinking it is Gmail and enters her credentials.

Edit:

In this animation, you see that while I am reading SE, the tab that at first looked harmless changes in the background to look like Gmail. This way the page tries to trick me into submitting my credentials.

Tabnabbing demo

  • 9
    Seems like the demo page you provided has been sort of broke since 2015. – Dog eat cat world Sep 8 '16 at 12:24
  • 9
    Indeed the screenshot of Gmail no longer shows. – Sjoerd Sep 8 '16 at 13:05
  • 103
    Lost 5 minutes waiting for the favicon to change, and then I remembered that I have NoScript enabled -.- – Bakuriu Sep 8 '16 at 15:30
  • 10
    Another good reason to just close tabs you're done with instead of letting them pile up. – Shelby115 Sep 8 '16 at 17:20
  • 14
    Here's a more effective demo created by Eitan Adler which uses meta refresh to open the demo phishing page. – Daniel Sep 8 '16 at 18:43
2

It is a form of social engineering attack through your web browser. You are asked to visit a malicious page which will only get loaded if you switch to another tab and back. There are some tools around to do this. Best for me is Social Engineering Toolkit. It comes pre-installed with Kali Linux along with other useful toys.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.