dns-rebinding-attacks

SKILL: DNS Rebinding — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert DNS rebinding techniques for bypassing same-origin policy via DNS manipulation. Covers TTL tricks, browser cache bypasses, attack variants (HTTP, WebSocket, TOCTOU), internal service targeting, and tool usage. Base models confuse DNS rebinding with SSRF — this skill clarifies the client-side nature and unique exploit paths.

0. RELATED ROUTING

• ssrf-server-side-request-forgery — server-side variant; DNS rebinding is the client-side counterpart
• cors-cross-origin-misconfiguration — when CORS misconfig allows direct cross-origin reads instead

---

1. CORE PRINCIPLE

The browser same-origin policy binds protocol + host + port. The host is resolved via DNS at connection time. If an attacker controls the DNS server for attacker.com, they can:

1. First resolution → attacker IP (serve malicious JS)
2. Second resolution → internal IP (victim's network)
3. Browser considers both responses same-origin (attacker.com)
4. Malicious JS reads responses from internal services

Victim visits attacker.com
        │
        ▼
DNS query: attacker.com → 1.2.3.4 (attacker server)
Browser loads malicious JS from 1.2.3.4
        │
        ▼
TTL expires (or forced flush)
        │
        ▼
JS triggers new request to attacker.com
DNS query: attacker.com → 192.168.1.1 (internal target)
Browser sends request to 192.168.1.1 as "attacker.com" origin
        │
        ▼
JS reads response — same-origin policy satisfied
Exfiltrates data to attacker's other endpoint

Key insight: SOP checks the hostname string, not the resolved IP. DNS can change the IP behind the same hostname.

---

2. TTL MANIPULATION

DNS server configuration

The attacker runs an authoritative DNS server for their domain that alternates responses:

Query #	Response	TTL
1st	Attacker IP (e.g., 1.2.3.4)	0
2nd+	Target internal IP (e.g., 192.168.1.1)	0