0

I see in last days so many posts about this attack but nothing to suggest how to stop in the enterprise would be great to know what would be a good steps to follow to mitigate this risk in the enterprise.

https://portswigger.net/daily-swig/new-tool-enables-dns-rebinding-tunnel-attacks-without-reconnaissance

  • This is not really a new attack but just existing attacks made easier. Insofar the existing protections against DNS rebinding still work. – Steffen Ullrich Apr 2 at 15:44
  • Any other new recommendations based on the recent update? – Filopn Apr 3 at 0:45
  • Again, the "new" attack just makes a complex DNS rebinding attack easier to execute. It changes nothing on the underlying idea of how DNS rebinding works. Therefore existing protections against DNS rebinding also block this new attack. There is no need to recommend anything else than to actually use existing methods of protection. – Steffen Ullrich Apr 3 at 2:29
  • Looking on the Wiki suggestions they are unrealistic for enterprise. Please read again the list of recommendations and if you are not clear how those are not applicable for enterprise (not SME) I will help to explain. – Filopn Apr 3 at 4:09
  • Yes, please explain why filtering out internal IP addresses returned as response from external DNS servers is not practical in an enterprise context. My understanding is that in enterprise environments the DNS is managed by the company anyway, since such a setup is already needed to resolve internal names. – Steffen Ullrich Apr 3 at 4:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.