🔄

DNS Rebinding Attack

Medium

Free preview · 2 of 5 steps

Bypassing SOP with DNS TTLs

The Same-Origin Policy prevents JavaScript on evil.com from reading responses from bank.com. But DNS rebinding exploits the gap between domain identity and IP address: the browser's SOP is based on domain name, not IP address.

An attacker can make a domain resolve to an external IP, then — after the browser has established 'origin' — change the DNS response to point to an internal IP. The browser's JS still believes it's talking to evil.com, but requests now go to your router.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step