Research Academy
My account Customers About Blog Careers Legal Contact Resellers

Burp Suite User Forum

Create new post

Scanner Check For target="_blank" Vulnerability

Surreal | Last updated: Sep 01, 2016 04:41PM UTC

Hi Portswigger, I would like to see a check added for links with target="_blank" without the rel="noopener noreferrer" attribute. The author of the below article demonstrates that the site which is linked to is able to control the location of the page containing the original link using window.opener. https://dev.to/ben/the-targetblank-vulnerability-by-example Thank you

PortSwigger Agent | Last updated: Sep 07, 2016 10:20AM UTC

Thanks for this request. We're aware of this issue and the potential it gives for phishing attacks when linking to malicious sites. Given the phishing impact, it's not currently a high priority for us. We'll keep this under review.

You must be an existing, logged-in customer to reply to a thread. Please email us for additional support.