ZAP Not Reporting 10108 Reverse Tabnabbing

[Bryan Fish]

I'm comparing scan results between Qualys WAS and ZAP.  Qualys reported Tabnabbing vulnerability, I assume because the page includes several links like this one:

<a class="dropdown-item" href="https://vimeo.com/nnnnn" target="_blank">Help Video</a>

I was also expecting an alert for 10108 Reverse Tabnabbing on ZAP, but it's not showing up.  Zap and Add-ons are up to date, and I've set the threshold for that rule to Low, Med, and High and I'm still not seeing the alert.

Any suggestions?  Thanks! 

[Simon Bennetts]

Hiya Bryan,

You should tell Qualys to update their rules :D

Modern browsers have an implicit rel="noopener" for "_blank" targets. The link you quoted to is safe from tabnabbing, which is why ZAP does not report it.

The only danger is if the "rel" attribute contains "opener" and not "noopener", so thats what ZAP checks for.

Cheers,

Simon

[Bryan Fish]

Hi Simon,

Thanks for the response, that makes a lot of sense.

>> You should tell Qualys to update their rules :D

That's both true and funny :)  

Thanks,

Bryan