I've been playing around with DNS rebinding. I made a little setup and I have it working fine with regular HTTP requests. I then tried to get it working over HTTPS and had a little "duh" moment:
baddomain.com uses an invalid security certificate.
The certificate is only valid for *.target.com
Error code: SSL_ERROR_BAD_CERT_DOMAIN
Browsers will check the cert for every request. With DNS rebinding, you are making subsequent request to the same "domain" but a different IP. The cert of the "rebinded" target doesn't match the originating domain, so we get a cert issue.
Is it safe to assume HTTPS services are not vulnerable to DNS rebinding attacks?