DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.

SKILL: DNS Rebinding — Expert Attack Playbook AI LOAD INSTRUCTION : Expert DNS rebinding techniques for bypassing same origin policy via DNS manipulation. Covers TTL tricks, browser cache bypasses, attack variants (HTTP, WebSocket, TOCTOU), internal service targeting, and tool usage. Base models confuse DNS rebinding with SSRF — this skill clarifies the client side nature and unique exploit paths. 0. RELATED ROUTING [ssrf server side request forgery](../ssrf server side request forgery/SKILL.md) — server side variant; DNS rebinding is the client side counterpart [cors cross origin misconfiguration](../cors cross origin misconfiguration/SKILL.md) — when CORS misconfig allows direct cross origin reads instead 1. CORE PRINCIPLE The browser same origin policy binds protocol + host + port . The host is resolved via DNS at connection time. If an attacker controls the DNS server for attacker.com , they can: 1. First resolution → attacker IP (serve malicious JS) 2. Second resolution → internal IP (victim's network) 3. Browser considers both responses same origin ( attacker.com ) 4. Malicious JS reads responses from internal services Key insight : SOP checks the hostname string, not the resolved IP. DNS can change the IP behind the same hostname. 2. TTL MANIPULATION DNS server configuration The attacker runs an authoritative DNS server for their domain that alternates responses: Query Response TTL 1st Attacker IP (e.g., 1.2.3.4 ) 0 2nd+ Target internal IP (e.g., 192.168.1.1 ) 0 TTL=0 tells resolvers not to cache the result, forcing re resolution on next connection. Browser DNS cache reality Browsers maintain their own DNS cache that ignores low TTLs : Browser Internal DNS Cache Bypass Technique Chrome ~60 seconds minimum Wait 60s; or use multiple subdomains Firefox ~60 seconds (network.dnsCacheExpiration) Adjustable in about:config Safari ~varies Generally shorter cache Edge (Chromium) Same as Chrome (~60s) Same techniques as Chrome Bypass strategies 3. ATTACK VARIANTS 3.1 Classic HTTP Rebinding Target: internal web services (admin panels, REST APIs) 3.2 WebSocket Rebinding WebSocket connections persist after DNS rebinding. Establish WS, then rebind: 3.3 Time of Check to Time of Use (TOCTOU) Server side applications that validate DNS at request time but reuse the connection: This is a hybrid with SSRF — the rebinding happens in the server's resolver. 3.4 Multiple A Records (Fastest Variant) 4. HIGH VALUE TARGETS Target Port Why Cloud metadata 169.254.169.254:80 AWS/GCP/Azure instance credentials, tokens Docker API 172.17.0.1:2375 Container creation, host filesystem mount → RCE Kubernetes API 10.96.0.1:443/6443 Pod creation, secret reading Internal admin panels Various Router config, NAS, printer, SCADA IoT devices 192.168.x.x:80/443 Camera feeds, smart home control Elasticsearch :9200 Data exfiltration, index manipulation Redis :6379 Data read, config set for RCE Consul/etcd :8500/2379 Service discovery, secret storage Cloud metadata specific IMDSv2 defense : requires X aws ec2 metadata token header from PUT request. Rebinding cannot easily set custom headers on the initial token request in no cors mode. 5. TOOLS Tool Purpose URL Singularity Full DNS rebinding attack framework github.com/nccgroup/singularity rbndr.us Quick rebind DNS service (IP pair in subdomain) rbndr.us whonow Dynamic DNS rebinding server github.com/taviso/whonow dnsrebinder Minimal Python DNS server for rebinding Custom / various repos Singularity quick start rbndr.us (zero setup) 6. DNS REBINDING vs. SSRF Aspect DNS Rebinding SSRF Execution context Client side (browser) Server side Origin bypass Same origin policy Network access controls Attacker controls DNS resolution URL/request sent by server Requires Victim visits attacker page Vulnerable server side fetch Internal access via Browser on victim's network Server's network position Credential inclusion Browser cookies auto included No user credentials Protocol support HTTP/WS (browser limited) Any protocol (gopher, file, etc.) Critical difference : DNS rebinding leverages the victim's browser as the pivot point, so it accesses services visible from the victim's network , with the victim's cookies/credentials . 7. DEFENSES AND DEFENSE BYPASS Common defenses Defense How it works DNS pinning Browser/resolver caches DNS and refuses re resolution Host header validation Server rejects requests with unexpected Host header Network segmentation Internal services not reachable from browser network Private network access (PNA) Chrome's proposal: preflight for requests to private IPs Authentication on internal services Internal services require auth, not just network access Defense bypass techniques 8. DECISION TREE 9. REAL WORLD EXPLOITATION CHECKLIST

dns-rebinding-attacks