DNS Rebinding
I want to know more about DNS Rebinding. I first learned about this topic when reading the Node.js documentation.
References
Notes
DNS rebinding is a method of manipulating resolution of domain names that is commonly used as a form of computer attack. In this attack, a malicious web page causes visitors to run a client-side script that attacks machines elsewhere on the network. DNS rebinding establishes communication between the attacker's server and a web application on an internet network through a browser.
Web browsers use same-origin policy as a defense mechanism to restrict how websites from one origin can interact with other origins. The origin of a website is defined by the protocol (http:.//
), domain (frankmbrown.net
) and port (:80
). Websites with the same-origin policy restrict cross-policy interactions.
In a DNS system, time to live (TTL) defines the amount of time in seconds that a record can be cached before a web server will re-query the DNS name server for a response. After the TTL expires, the records become stale and will not be used. TTL is usually set by the authoritative name server of a domain.
The goal of the DNS rebinding attack is to bypass the restrictions of the Same-Origin-Policy.
The attackers register the domain http://www[.]badactor[.]com and delegate it to a DNS server they control. Company Yourname Inc. hosts its intranet behind a firewall. Employees of Yourname Inc. can access an application on a company’s web server, whose IP is 60.6.6.60. Let’s assume an employee of Yourname Inc. is surfing the internet from a laptop or tablet inside the company’s network and clicks on www[.]badactor[.]com. The DNS server controlled by the bad actor sends the correct IP address to the employee’s request but with a very short TTL to prevent the response from being cached. Remember, it’s the DNS server that sets the TTL policy. The employee’s browser downloads the page containing malicious code that binds the local IP address to the attacker’s DNS server. The domain www[.]badactor[.]com now points to 60.6.6.60, and because this IP is of the same origin, the attacker’s code can exfiltrate the company’s information and sensitive data.
The best mitigation against DNS rebinding attacks is at the DNS layer.
DNS rebinding is a type of cyberattack that leverages Domain Name System (DNS) to run malicious JavaScript and attack devices on a user's private network.
Comments
You have to be logged in to add a comment
User Comments
There are currently no comments for this article.