Turning A Browser Into A Proxy
DNS rebinding tricks a victim's browser into talking to internal services that the attacker cannot reach directly. The attacker controls a domain whose DNS answer changes from their own server to a private address after the page loads.
The Sequence
- The victim visits the attacker domain, which first resolves to the attacker's server.
- Script on the page keeps the page open while the DNS record is rebound to an internal IP.
- The browser, still treating it as the same origin, now sends requests to the internal host.
Defenses
- Have services validate the Host header and reject unexpected names.
- Block responses that resolve public names to private IP ranges at the resolver.
- Require authentication on internal services rather than trusting network location.
Key idea
DNS rebinding swaps a domain to a private IP after load so the browser reaches internal services, so validate Host headers and authenticate internal endpoints.