News for hackers. Stuff that matters.

A comment on Insecure by default – hijacking websites that use target=“_blank”. Parent comment

Re:Insecure by default – hijacking websites that use target=... by Retr0spectrum on Wednesday October 05, 2016 @03:31PM (#12646999)
See this comment for a cross-domain demo: https://news.ycombinator.com/item?id=11631810

It's a fairly big deal, but not much is being done about it on the browser side of things. It can only really be used for phishing style attacks.

[ Parent | on HN ]
Re:Insecure by default – hijacking websites that use target=... by magicalist on Wednesday October 05, 2016 @03:36PM (#12647038)
you cannot access the opener's document as aji's example does cross origin
[ Parent | on HN ]
Re:Insecure by default – hijacking websites that use target=... by Retr0spectrum on Wednesday October 05, 2016 @03:41PM (#12647080)
Sorry, I didn't read the comment carefully enough.

I assumed we were still talking about window.opener.location (which can be modified across domains)

[ Parent | on HN ]