Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/wstg-clnt-14
Testing for Reverse Tabnabbing
Passed 22 of 23 test cases with the skill, and 19 of 23 without it.
3 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a forum application where untrusted users can submit arbitrary target="_blank" links without rel attributes, what CVSS score is assigned for user-generated content link reverse tabnabbing?
| Checked | Without skill | With skill |
|---|---|---|
| The response rates user-generated links missing noopener as CVSS 5.4 with Medium severity. | Missed | Passed |
The instructions your model reads when the skill loads.
WSTG-CLNT-14
Testing for Reverse Tabnabbing
Reverse Tabnabbing is a phishing attack where a malicious page opened via target="_blank" can modify the opener page's location through window.opener. This can redirect users to a phishing page while they believe they're still on the original site.
#!/bin/bash
TARGET="https://target.com"
# Find links with target="_blank"
echo "[*] Finding target=_blank links..."
curl -s "$TARGET" | grep -oP '<a[^>]*target=["\']_blank["\'][^>]*>' | while read -r link; do
echo "Link: $link"
test cases passed, vs 19 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.