domains / families / security / dns-rebinding-attacks
dns-rebinding-attacks
separate
DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.
When to use
- Testing applications that trust DNS resolution for origin checks
- Interacting with internal services from browser context
- Exploiting client-side fetch/XHR to attacker-controlled domains
- Bypassing same-origin policy via DNS manipulation
- TTL tricks and browser cache bypasses
- HTTP, WebSocket, and TOCTOU attack variants
- Targeting internal services like cloud metadata and Docker API
When not to use
- Server-side SSRF where the server initiates the request
- Direct cross-origin reads enabled by CORS misconfiguration
Skill page
Source